The Agent Skills Directory

[DATA_EXFILTRATION]: Automated reputation scanners have flagged the 'README.md' file as malicious ('FileRepMalware'). This indicates that the file content, associated metadata, or embedded links have been linked to known malicious patterns or low-reputation signatures.
[INDIRECT_PROMPT_INJECTION]: The skill can process content from untrusted external URLs ('source.url') and uploaded PDFs ('source.assetId') to generate video scripts. These scripts can then be automatically published to connected social media platforms like YouTube and TikTok. This creates a surface where malicious instructions embedded in a web page or document could influence the agent's actions or the content published to the user's social channels. * Ingestion points: 'SKILL.md' (via 'source.url' and 'source.assetId' parameters). * Boundary markers: Absent; there are no instructions to disregard potential commands within the fetched content. * Capability inventory: 'POST /publications' (social media posting), 'POST /videos/generate' (content creation), 'Bash/curl' (network interaction), and 'Write' (local file system access). * Sanitization: Not specified in the skill instructions.
[COMMAND_EXECUTION]: The skill instructions frequently use 'curl' to interact with the AITuber API and provide example shell scripts that pipe output into 'jq' for parsing. It also recommends installation via 'npx'.
[EXTERNAL_DOWNLOADS]: The skill facilitates the download of rendered video files (MP4) from signed temporary URLs and recommends the installation of the '@aituber/mcp-server' and 'aituberapp/ai-video-skill' packages from npm. These are vendor-provided resources.

aituber-api