The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill possesses an attack surface where untrusted data could influence its behavior, specifically regarding where files are written and how API requests are structured.
Ingestion points: The script scripts/speak.sh accepts several command-line arguments (text, --voice, --model, --format, --speed, --out) which are typically populated by the agent based on user instructions.
Boundary markers: Absent. There are no instructions or delimiters in SKILL.md to prevent the agent from obeying instructions embedded within the text intended for speech conversion.
Capability inventory: The skill uses curl to perform network operations and mkdir followed by curl -o to write files to the local file system.
Sanitization: While the text field is safely escaped using jq -Rs ., other variables like ${model}, ${voice}, and ${out} are interpolated directly into a JSON template or shell commands without validation or escaping.
[COMMAND_EXECUTION]: The script performs file system operations based on unvalidated user-controlled input.
Evidence: In scripts/speak.sh, the commands mkdir -p "$(dirname "$out")" and curl ... -o "$out" use the $out variable directly. If an agent is induced to provide a sensitive path (e.g., configurations or startup scripts), the tool will attempt to write the API response to that location.

openai-tts