The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes shell commands using yt-dlp and a Python script (fetch_tweet.py) with user-provided URLs interpolated directly into the command string ("{URL}"). This pattern is vulnerable to command injection if the URL contains shell metacharacters that bypass the double-quoting.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources including YouTube transcripts, X/Twitter posts, webpages, and PDF files to generate summaries and interactive quizzes.
Ingestion points: Content is fetched from arbitrary URLs via yt-dlp, a Python scraper script, a headless browser (mcp__claude-in-chrome), and the file Read tool.
Boundary markers: The instructions for the subagent (Phase 2-1) do not include specific delimiters or warnings to ignore instructions embedded in the source content, allowing potential instruction override.
Capability inventory: The skill has access to WebSearch, file system writing (research/digests/), shell execution, and subagent instantiation.
Sanitization: Content cleaning focuses on removing timestamps and formatting for transcript clarity, but does not perform security-focused sanitization to prevent injection attacks.
[CREDENTIALS_UNSAFE]: The YouTube extraction instructions mention the optional use of the --cookies-from-browser chrome flag for yt-dlp. This allows the tool to access sensitive browser session data and authentication cookies, which could be exposed or misused in a shared environment.
[EXTERNAL_DOWNLOADS]: The skill performs automated network requests to fetch content from various user-provided domains and performs automated web research based on extracted keywords, interacting with arbitrary remote servers.

content-digest