The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads MP3 audio files and metadata from the ccMixter platform. While this is the intended purpose, the implementation explicitly disables SSL/TLS certificate verification by setting rejectUnauthorized: false in the HTTPS agent configuration within scripts/bgm.js and scripts/downloader.js. This configuration makes the network requests vulnerable to Man-in-the-Middle (MitM) attacks, although the documentation notes this is a workaround for an incomplete certificate chain on the host's server.
[INDIRECT_PROMPT_INJECTION]: The skill fetches and displays track metadata (titles, artist names, tags) from a public API. This content is untrusted and is subsequently written to local files (music_manifest.json, ATTRIBUTION.txt) and printed to the console.
Ingestion points: API responses from https://ccmixter.org/api/query are processed in scripts/bgm.js.
Boundary markers: No specific delimiters or "ignore instructions" warnings are used when printing API-sourced strings to the terminal or manifest files.
Capability inventory: The skill uses fs.writeFile to create persistent manifest and attribution files, and axios for network operations.
Sanitization: Filenames are sanitized by replacing non-alphanumeric characters with underscores, but title and license metadata strings are not sanitized before being processed or written to disk.

bgm-library