The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill requires the installation of an external dependency from an untrusted source: https://github.com/kimtaeyoon83/mcp-server-youtube-transcript.git. The instructions direct the agent to clone this repository and execute npm install && npm run build, which involves executing arbitrary code from a remote repository during the build process.
[COMMAND_EXECUTION]: The skill relies on executing shell commands for its core functionality, including the use of node -e to run inline JavaScript. This pattern provides a significant attack surface if video ID or language parameters are manipulated.
[PRIVILEGE_ESCALATION]: The skill instructs the agent to create directories and install software within the /root/ directory structure (e.g., /root/clawd/). Accessing or modifying files in /root/ typically requires elevated privileges, which the agent is encouraged to assume.
[DYNAMIC_EXECUTION]: The skill generates and executes JavaScript at runtime using the node -e flag to bridge the shell environment with the installed MCP server. It passes variables into the script context, which could lead to code injection if not carefully handled.
[DATA_EXFILTRATION]: The skill includes functionality to send local files from the filesystem to an external Telegram channel using the message --action send command. When combined with the ability to read system-level data, this provides a mechanism for unauthorized data removal.
[INDIRECT_PROMPT_INJECTION]: The skill possesses a significant attack surface for indirect prompt injection via external video content.
Ingestion points: Untrusted transcript data is fetched from YouTube and loaded into the agent's context in SKILL.md (Step 2 and 3).
Boundary markers: The skill lacks delimiters or safety instructions to prevent the agent from obeying instructions embedded within the transcript text.
Capability inventory: The agent has access to shell execution, file writes in privileged directories, and remote messaging platforms (Telegram).
Sanitization: No sanitization, escaping, or validation is performed on the transcript text before it is processed for summarization or saved to the filesystem.

youtube-summarizer