The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill directs users to documentation hosted on sosumi.ai instead of the official Apple Developer site (developer.apple.com). Relying on third-party domains for system API documentation can expose developers to inaccurate information or potential phishing vectors.
[METADATA_POISONING]: The skill specifies compatibility targets for iOS 26 and Swift 6.3, both of which are currently non-existent future versions. This misleading versioning information can lead to confusion regarding the skill's actual operational environment.
[INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of external Apple Music catalog data and provides code to perform library modifications and playback, creating a potential vector for data-driven attacks. * Ingestion points: Music item collections returned from MusicCatalogSearchRequest and MusicCatalogChartsRequest in SKILL.md and references/musickit-patterns.md. * Boundary markers: None; the code does not implement delimiters or warnings to ignore instructions embedded in song or artist metadata. * Capability inventory: Includes the ability to queue and play media via ApplicationMusicPlayer and add items to the user library via MusicLibrary.shared.add(). * Sanitization: External metadata is passed directly to system APIs and rendered in SwiftUI views without sanitization for instruction-like strings.

musickit