The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill performs an automatic installation of the yt-dlp package from the official Python Package Index (PyPI).
Evidence: The check_yt_dlp function in scripts/download_video.py uses pip install to ensure the dependency is present before execution.
[COMMAND_EXECUTION]: The script uses the subprocess module to execute system commands for installing packages and running the video downloader.
Evidence: scripts/download_video.py contains multiple subprocess.run calls to interface with pip and yt-dlp.
[PROMPT_INJECTION]: The skill has an indirect prompt injection surface because it processes untrusted data (video metadata) from an external source (YouTube) and prints it to the console, where it enters the agent's context.
Ingestion points: scripts/download_video.py fetches metadata using yt-dlp --dump-json.
Boundary markers: None present; external strings like the video title are printed directly to standard output.
Capability inventory: The script has the capability to execute shell commands via subprocess.run and write files to the filesystem.
Sanitization: No sanitization or filtering is performed on the metadata (title, uploader name) retrieved from YouTube before it is displayed.

youtube-downloader