The Agent Skills Directory

[SAFE]: No malicious patterns or security vulnerabilities were detected in the skill instructions or provided code examples. The skill acts as a developer guide for lip-sync and dubbing integrations.- [CREDENTIALS_UNSAFE]: The skill correctly recommends storing API keys in environment variables (SYNC_API_KEY) and using .env files, which are excluded from version control, to prevent accidental credential exposure. It explicitly warns against including keys in client-side bundles or logs.- [EXTERNAL_DOWNLOADS]: The skill references official SDKs (syncsdk, @sync.so/sdk) and API endpoints (api.sync.so) belonging to the author's organization, which is consistent with the skill's stated purpose.- [INDIRECT_PROMPT_INJECTION]: The skill provides templates for processing user-supplied files and text scripts, representing a typical integration surface.
Ingestion points: Local media file paths and text-to-speech script content in Python and TypeScript reference code.
Boundary markers: The skill uses structured JSON for API communication.
Capability inventory: Includes file system reading and network requests required for the primary functionality of uploading and processing media.
Sanitization: The implementation relies on standard language-level JSON serialization which provides basic protection against injection during data transmission.

sync-api