The Agent Skills Directory

[PROMPT_INJECTION]: The skill retrieves and processes untrusted external data from YouTube, including video titles, descriptions, and public comments. This creates a surface for indirect prompt injection where malicious instructions embedded in YouTube content could influence the agent's behavior.
Ingestion points: Data is ingested via the search, get_video_details, and list_public_comments actions.
Boundary markers: The instructions lack explicit boundary markers or warnings to the agent to disregard instructions found within the fetched data.
Capability inventory: The skill relies on remote API calls and does not have local file system or command execution privileges.
Sanitization: There is no documentation of input sanitization or filtering of the retrieved YouTube content.
[EXTERNAL_DOWNLOADS]: The skill body provides instructions and commands to download auxiliary setup skills from the author's GitHub repository (AgentPMT/agent-skills) and the clawhub.ai marketplace. These represent standard vendor-distributed resources for the platform.

youtube-discovery