The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on executing system binaries (ffmpeg, ffprobe, yt-dlp) via subprocess.run. While it correctly uses list-based arguments to prevent shell injection, the integrity of the analysis depends on the presence and security of these externally installed tools.
[INDIRECT_PROMPT_INJECTION]: The skill extracts and processes untrusted textual data (captions/transcripts) from external video sources or local files.
Ingestion points: Captions are fetched from URLs via yt-dlp or read from local sidecar files. These are saved to transcript.md, which the agent is then instructed to read to answer user questions.
Boundary markers: The skill does not wrap the untrusted transcript content in specific delimiters or provide explicit instructions to the agent to disregard commands or directives found within the transcript text.
Capability inventory: The logic allows the execution of system commands for media handling and has read/write access to the local runtime directory for artifact generation.
Sanitization: Content undergoes basic cleaning (e.g., stripping HTML tags from VTT files), but there is no mechanism to detect or sanitize malicious prompt injection attempts embedded in the text content.
[EXTERNAL_DOWNLOADS]: When a URL is provided, the skill uses yt-dlp to download video content and subtitles to the local workspace for processing.
[DATA_EXPOSURE]: The skill accesses local files and external URLs provided by the user. It contains logic to redact query parameters from manifests and warns the user if the input URL appears to contain sensitive authentication tokens (e.g., jwt, access_token).

video-watch