The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes local command-line tools to perform media processing and downloads.
Evidence: scripts/process_downloads.py calls yt-dlp and gallery-dl using the subprocess.run() method. The commands are passed as lists of arguments rather than strings, which is a secure practice that prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill is designed to download content from the internet into the local file system.
Evidence: scripts/process_downloads.py fetches videos, images, and metadata JSON files. The script implements a restrictive domain check, specifically limiting processing to YouTube and X (Twitter), which significantly reduces the risk of interacting with malicious third-party sites.
[INDIRECT_PROMPT_INJECTION]: The skill has an ingestion surface for data from external web platforms, which could contain instructions intended to influence an AI agent.
Ingestion points: scripts/process_downloads.py downloads content from external URLs and stores it within the Obsidian vault as Markdown and metadata files.
Boundary markers: Absent; metadata such as video descriptions are written to Markdown files without explicit delimiters or safety warnings.
Capability inventory: The skill has the capability to write to the filesystem and execute specific local binaries via subprocess.run() in scripts/process_downloads.py.
Sanitization: Present; the sanitize_filename function in scripts/process_downloads.py uses regular expressions to remove characters that could be used for directory traversal or causing filesystem errors.

online-content-collector