The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads images from YouTube's official servers (img.youtube.com) and arbitrary remote URLs provided by the user using the requests library in recreate_thumbnails.py. This is a functional requirement for the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a surface for indirect prompt injection through the processing of external images.
Ingestion points: External image data enters the agent context via the youtube_url and source URL parameters defined in SKILL.md and handled in recreate_thumbnails.py.
Boundary markers: The system prompt in recreate_thumbnails.py uses explicit labels (e.g., "IMAGE 1", "IMAGE 2") to help the model distinguish between reference and target images.
Capability inventory: Capabilities are limited to image downloads via requests, local file writes within the .tmp/ directory, and invocation of the Google GenAI API. No arbitrary command execution or subprocess spawning is present.
Sanitization: Video IDs from YouTube URLs are validated using regular expressions, though the raw content of downloaded images is not sanitized before being passed to the vision model.
[SAFE]: The skill correctly manages sensitive credentials by instructing users to store the API key in a .env file rather than hardcoding it. No patterns of obfuscation, persistence, or privilege escalation were found.

recreate-thumbnails