The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses the subprocess module in scripts/scout.py and tests/test_repo_hygiene.py to execute shell commands. These calls are for legitimate purposes, such as running yt-dlp for metadata extraction, ffmpeg for media processing, and git for repository hygiene checks.
[INDIRECT_PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it ingests untrusted data from the YouTube API and yt-dlp probes.
Ingestion points: scripts/scout.py fetches video titles, descriptions, tags, user comments, and transcripts from YouTube.
Boundary markers: The script prints a summary table and writes data to an Excel file, but does not wrap the potentially untrusted strings in delimiters or include instructions for the agent to ignore embedded commands.
Capability inventory: The skill has the capability to run subprocesses (yt-dlp, ffmpeg, git), write to the file system (Excel workbooks and downloads), and perform network operations via urllib.
Sanitization: The script performs basic whitespace normalization using regex on ingested text but does not implement robust sanitization or escaping of the external content.

scout