The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied text and audio files, including those hosted at remote URLs, which creates a surface for indirect prompt injection if the inputs contain adversarial content.
Ingestion points: The clone command accepts user-provided text via the --text argument, and the enroll command accepts remote audio files via the --sample-url argument in SKILL.md.
Boundary markers: The instructions do not define delimiters or safety instructions to prevent the agent from interpreting potential commands embedded in the synthesis text or audio metadata.
Capability inventory: The skill executes the local script skills/shared/scripts/voice_clone.py, which performs network requests to external cloud providers and writes output files to the outputs/ directory.
Sanitization: There is no evidence of sanitization or validation of the --text input or remote audio content before it is processed by the script.

voice-clone