The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill communicates with the official Last.fm API endpoint (ws.audioscrobbler.com) to retrieve and update user music data. This is a well-known service and is the primary function of the skill.
[COMMAND_EXECUTION]: The core logic in scripts/lastfm-api.sh uses standard system utilities curl and jq to perform network requests and parse JSON data. The script includes appropriate error handling and uses set -euo pipefail for robustness.
[PROMPT_INJECTION]: The skill processes untrusted data (such as track names and artist information) from the Last.fm API, which presents a surface for indirect prompt injection.
Ingestion points: API responses are parsed and formatted in scripts/lastfm-api.sh (e.g., in format_now_playing and format_recent functions).
Boundary markers: No specific delimiters or "ignore instructions" warnings are applied to the fetched metadata before it is presented to the agent.
Capability inventory: The skill possesses network capabilities via curl and JSON processing via jq.
Sanitization: The skill correctly sanitizes user inputs (like artist and track names) using URL encoding via jq before they are included in API requests, preventing request-level injection.

lastfm