The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts asr_transcribe.py, snap_breath.py, and validate_edl.py execute ffmpeg and ffprobe using the subprocess module. These calls are implemented using argument lists rather than shell strings, which is a secure practice that prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill communicates with doubaoya.com to perform speech-to-text transcription. This network operation is integral to the skill's primary function. The domain is associated with the skill's vendor and use of the service is clearly documented in the instructions.
[CREDENTIALS_UNSAFE]: The skill requires a DOUBAOYA_API_KEY. The documentation correctly advises users to manage this secret via environment variables and includes explicit warnings against hardcoding the key or printing it in logs. No hardcoded secrets were found in the analyzed files.
[DATA_EXFILTRATION]: While the skill sends audio data to an external API for transcription, this is the intended functionality. The data transmission targets a vendor-specific endpoint and does not involve the exfiltration of sensitive system files or user credentials.

celebrity-slice