The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module to manage a pipeline of command-line tools for audio conversion and disc burning. This includes drutil for hardware status, hdiutil for ISO filesystem creation, and cdrdao for SCSI-level disc writing. The implementations avoid shell=True and pass arguments as lists, mitigating command injection risks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of audio file metadata (ID3 tags) extracted via ffprobe.\n
Ingestion points: Metadata such as Title, Artist, and Album are read from user-provided audio files in scripts/build_toc.py.\n
Boundary markers: The metadata is written into a Table of Contents (TOC) file inside double-quoted CD_TEXT blocks.\n
Capability inventory: The skill executes cdrdao write using the generated TOC, which controls the low-level data written to the disc.\n
Sanitization: The build_toc.py script employs an escape_toc_string function that specifically escapes backslashes and double-quotes, ensuring that malicious metadata cannot break out of the TOC format to influence the burning process.\n- [SAFE]: The skill implements remote staging via SSH in scripts/stage_tracks.py. It correctly uses shlex.quote to sanitize remote paths and restricts the command set to a fixed list of audio formats, effectively preventing remote command injection through the user-supplied source paths.

disc-forge