The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The bootstrap.sh script and README.md instructions encourage users to execute code directly from the vendor's GitHub repository using bash <(curl -fsSL ...). This pattern facilitates the execution of remote scripts without prior local inspection.
[DATA_EXFILTRATION]: The scripts/transcript.py file disables SSL certificate verification by setting ssl.create_default_context().verify_mode = ssl.CERT_NONE. This vulnerability allows for the potential exposure and interception of the DOUBAO_API_KEY (sent as a Bearer token) by a Man-in-the-Middle (MitM) attacker on the network.
[COMMAND_EXECUTION]: The skill uses subprocess.run to execute external binaries including ffmpeg, ffprobe, yt-dlp, and curl for video processing tasks. The arguments for these commands are dynamically constructed from user-provided video URLs.
[PERSISTENCE]: During installation, bootstrap.sh creates a configuration file in ~/.codex/prompts/video-transcript.md. This file persists on the user's system to provide integrated prompt instructions for the Codex platform.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted video and audio content and includes it in a prompt sent to an LLM. An attacker could embed audio-based instructions to manipulate the model's transcription output.
Ingestion points: Audio data processed via API call in scripts/transcript.py.
Boundary markers: The prompt specifies transcription rules but lacks clear delimiters to separate the system instructions from the processed content.
Capability inventory: File system access, network communication, and shell command execution.
Sanitization: There is no filtering or sanitization performed on the audio content before it is sent to the transcription model.
[DYNAMIC_EXECUTION]: The platform_extractor.py script uses page.evaluate() within a Playwright browser context to execute JavaScript for metadata and URL extraction from various video platforms.
[EXTERNAL_DOWNLOADS]: The install.sh script downloads the Homebrew installer from raw.githubusercontent.com/Homebrew/install/HEAD/install.sh. This reference to a well-known service is documented as a standard part of the environment setup.

video-transcript