The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill metadata specifies a requirement to install the sag binary from a third-party Homebrew tap (steipete/tap/sag). While the developer is known in the macOS community, this remains an external dependency from a non-trusted vendor list.
[COMMAND_EXECUTION]: The primary functionality of the skill is achieved through the execution of shell commands (e.g., sag -v Clawd -o /tmp/voice-reply.mp3 "Your message here"). This involves spawning subprocesses to run the sag CLI tool.
[CREDENTIALS_UNSAFE]: The skill requires the environment variables ELEVENLABS_API_KEY or SAG_API_KEY. These keys grant access to a paid service and must be handled securely by the agent environment.
[PROMPT_INJECTION]: The skill exhibits a surface for indirect prompt injection and shell command injection by interpolating untrusted data into command-line arguments.
Ingestion points: The text to be spoken is taken from user requests and passed directly to the sag command as shown in SKILL.md examples.
Boundary markers: Basic double-quoting is used in examples, but there are no explicit instructions or mechanisms to sanitize or ignore embedded shell control characters (like backticks or subshells).
Capability inventory: The skill possesses the capability to execute the sag binary and write output to the /tmp directory.
Sanitization: No sanitization, escaping, or validation of the input text is provided within the skill instructions.

SAG