The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's installation process utilizes remote script execution patterns.
README.md and bootstrap.sh instruct users to run bash <(curl -fsSL https://raw.githubusercontent.com/Backtthefuture/video-transcript/main/bootstrap.sh), which executes code directly from the vendor's repository.
install.sh executes the Homebrew installation script using bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)" to set up system dependencies.
[COMMAND_EXECUTION]: Multiple Python scripts invoke system tools via shell commands to process media files.
transcript.py uses subprocess.run to call ffmpeg, ffprobe, and yt-dlp for downloading and converting video files.
asr_daemon.py uses subprocess.Popen to manage a background ASR service.
diarize_asr.py invokes ffprobe to determine media duration and ffmpeg for audio extraction.
[CREDENTIALS_UNSAFE]: The skill manages platform-specific credentials to access restricted content.
scripts/sph_resolver.py accesses sensitive login state data stored in ~/.workbuddy/credentials/yuanbao_state.json to authenticate with Tencent's Yuanbao service and resolve WeChat Video Channel links.
[PRIVILEGE_ESCALATION]: The installation flow involves operations that typically require elevated permissions.
install.sh triggers the Homebrew installer, which frequently requests sudo access to install system-wide packages like ffmpeg.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data which presents an injection surface.
Ingestion points: Transcripts are generated from external video and podcast content sourced from Bilibili, YouTube, Douyin, and WeChat (found in transcript.py).
Boundary markers: The skill instructions in SKILL.md advise the agent to "only perform term correction and title polishing" and avoid rewriting views, but there are no strict data delimiters for the transcript text.
Capability inventory: The agent can execute shell commands, read/write local files, and perform network requests.
Sanitization: There is no evidence of sanitization of the transcript text before it is presented to the agent for post-processing.
[DYNAMIC_EXECUTION]: The skill uses browser automation and subprocesses to handle dynamic content.
scripts/platform_extractor.py uses playwright to execute JavaScript in a headless browser to extract direct video URLs from platforms like Douyin and Bilibili.

video-transcript