The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill provides detailed security guidance on yt-dlp's mechanism for solving YouTube 'nsig' challenges, which involves executing remote JavaScript. It evaluates the risks of different runtimes (Node vs Deno) and recommends using the Deno sandbox for automated tasks to minimize exposure.\n- [CREDENTIALS_UNSAFE]: The skill contains comprehensive documentation on managing authentication cookies. It warns about the sensitivity of cookie files, recommends restrictive filesystem permissions (chmod 600), and advises against using primary accounts for bulk downloads to mitigate the risk of account bans.\n- [EXTERNAL_DOWNLOADS]: Includes a maintenance script (check-ytdlp-version.sh) that queries the official GitHub API to verify the installation's freshness. This check is performed using trusted infrastructure and is used to advise users on necessary updates to prevent extractor breakage.\n- [INDIRECT_PROMPT_INJECTION]: Recognizes that media metadata (e.g., video titles from YouTube) is untrusted input. The skill provides specific mitigations, including the --restrict-filenames flag and UTF-8-safe byte-truncation (%(title).100B), to prevent malformed or malicious metadata from affecting the filesystem or shell operations.\n- [COMMAND_EXECUTION]: The skill provides structured command-line patterns for yt-dlp and a local bash script for version verification. It emphasizes the use of defensive flags like --simulate and --print to verify output before execution, reducing the risk of unintended operations.

ytdlp-ops