The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches a sound effect catalog and corresponding audio assets from vendor-owned domains.
Evidence: Downloads from https://www.woven.video/sfx/catalog.json and https://assets.sfx.woven.video in scripts/pull-library.sh.
[REMOTE_CODE_EXECUTION]: The skill's setup instructions and helper scripts involve executing code from remote sources.
Evidence: The setup guide in references/mcp-setup.md directs users to run npx -y woven-sfx-mcp, and scripts/pull-library.sh fetches remote catalog data for processing via a shell pipeline.
[DYNAMIC_EXECUTION]: A helper script uses inline Node.js execution to process the downloaded catalog and perform parallel file downloads.
Evidence: The node -e command in scripts/pull-library.sh executes an embedded JavaScript snippet to handle HTTP requests and file system operations.
[COMMAND_EXECUTION]: The library management script utilizes shell commands for environment resolution and directory management.
Evidence: Use of curl, mkdir, grep, and sed within scripts/pull-library.sh to manage local sound assets.
[INDIRECT_PROMPT_INJECTION]: The skill ingests external data (sound metadata and catalog entries) that is presented to the agent, creating a surface for potential instruction injection through malicious catalog content.
Ingestion points: Remote catalog data fetched in scripts/pull-library.sh and results returned by the sfx_search and sfx_pull tools.
Boundary markers: Not explicitly implemented in the provided scripts.
Capability inventory: Network access (curl, https.get), file system writes (mkdir, fs.writeFileSync), and command execution (node -e).
Sanitization: Employs JSON.parse to validate the structure of the incoming catalog data.

add-sfx