The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches the latest release version information from the official yt-dlp GitHub repository API (api.github.com/repos/yt-dlp/yt-dlp/releases/latest) to verify installation freshness. This is a maintenance function targeting a well-known and trusted source.
[COMMAND_EXECUTION]: The skill utilizes the Bash tool to execute yt-dlp and ffmpeg commands. These operations are core to the skill's purpose of media acquisition and processing. The instructions include parameterization and safety flags (e.g., --restrict-filenames) to mitigate common shell injection risks.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external platforms, such as video titles and descriptions. It mitigates potential prompt injection risks by recommending byte-level truncation (%(title).100B) and sanitization flags. While the attack surface exists for any tool processing web content, the skill provides specific instructions to handle these artifacts safely.
[DYNAMIC_EXECUTION]: The documentation identifies that yt-dlp may execute obfuscated JavaScript from the network to solve signature challenges. The skill author responsibly documents the security implications of this third-party tool behavior and recommends using Deno's sandboxed environment to mitigate execution risks.
[CREDENTIALS_SAFE]: The skill provides instructions for using browser cookies to access gated content. It explicitly warns users against committing cookies.txt files and recommends restrictive file permissions (chmod 600), demonstrating an adherence to security best practices for credential handling.

ytdlp-ops