The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (prompt, lyrics) and passes it to external APIs and local processing scripts.
Ingestion points: Data enters the context via the prompt and lyrics fields, which can be sourced from external files (e.g., lyrics.txt).
Boundary markers: The instructions do not specify any delimiters or safety warnings to ignore embedded instructions within the prompts or lyrics.
Capability inventory: The skill performs network operations via urllib, writes files to the outputs/ directory, and executes subprocesses (local Python scripts for audio/video manipulation).
Sanitization: No evidence of sanitization or validation of the input strings is provided before they are used in commands.
[COMMAND_EXECUTION]: The execution examples in the documentation demonstrate unsafe shell interpolation of user-controlled files.
Evidence: The example python skills/shared/scripts/ai_music.py generate ... --lyrics "$(cat lyrics.txt)" uses shell substitution. If the content of lyrics.txt contains shell metacharacters like backticks, semicolons, or $(), it could lead to arbitrary command execution if the agent or user executes the command verbatim in a shell environment.

ai-music