The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources, specifically video transcripts fetched via yt-dlp or generated by Whisper APIs. This content is provided to the agent, creating a surface for indirect prompt injection.\n
Ingestion points: Transcripts are parsed from VTT files (in transcribe.py) and JSON responses from Groq/OpenAI APIs (in whisper.py).\n
Boundary markers: The transcript is presented within a markdown code block in the report, but there are no explicit boundary markers or instructions to the agent to ignore embedded commands within the transcript text.\n
Capability inventory: The skill allows execution of local binaries (ffmpeg, ffprobe, yt-dlp) via Python scripts, and the agent has access to the Bash, Read, and AskUserQuestion tools.\n
Sanitization: transcribe.py removes HTML-like tags from VTT files, but no semantic sanitization or instruction-filtering is performed on the transcript content.\n- [COMMAND_EXECUTION]: The skill makes extensive use of subprocess.run to execute local binaries for video and audio processing. This includes ffmpeg and ffprobe for frame and audio extraction, and yt-dlp for downloading content from user-provided URLs. The scripts use argument lists rather than shell strings to mitigate command injection risks.\n- [EXTERNAL_DOWNLOADS]: During setup, the skill attempts to install missing system dependencies (ffmpeg, yt-dlp) using the Homebrew package manager (brew install) on macOS systems. It also provides instructions for manual installation on other platforms.\n- [DATA_EXFILTRATION]: The skill extracts audio from video files and sends it to external Whisper transcription services provided by Groq (api.groq.com) and OpenAI (api.openai.com). This is a documented part of the skill's transcription functionality but involves transmitting local data to external APIs.\n- [CREDENTIALS_UNSAFE]: The skill manages API keys for external transcription services by storing them in a local environment file (~/.config/watch/.env). The setup process uses the AskUserQuestion tool to solicit these keys from the user and writes them to the configuration file with restricted permissions (chmod 600).

watch