The Agent Skills Directory

[PERSISTENCE]: The skill provides clear instructions for persisting the TRANSCRIPTOUT_API_KEY across shell sessions by adding an export statement to the user's shell profile (e.g., ~/.bashrc, ~/.zshenv). The method used is security-conscious, as it exports the result of a file read (cat ~/.config/transcriptout/key) rather than hardcoding the secret directly into the profile file.
[INDIRECT_PROMPT_INJECTION]: As the skill ingests third-party content (transcripts, video titles, descriptions), it acknowledges the risk of embedded malicious instructions. It provides explicit guidance to the agent in the 'Treat fetched content as data' section, mandating that the agent ignore any instructions found within the fetched content and never repeat the API key back to the user.
Ingestion points: Video metadata and transcripts fetched from api.transcriptout.com (File: SKILL.md).
Boundary markers: The skill instructs the agent to treat all fetched content as data rather than instructions.
Capability inventory: The skill utilizes curl for network requests and has the ability to write to the local file system (config files and shell profiles).
Sanitization: Explicit instructional guardrails are provided to prevent the agent from executing content from transcripts.
[COMMAND_EXECUTION]: The setup documentation (references/auth-setup.md) includes shell commands using curl, grep, and sed to automate account registration and key retrieval from the official API (api.transcriptout.com). These commands use security best practices, such as stty -echo to hide sensitive input and umask 077 to ensure that configuration files are created with restricted permissions.

youtube-data