The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts use subprocess.run to call yt-dlp. This is implemented safely using list-based arguments rather than string concatenation, which prevents shell injection. Additionally, download_video.py includes a strict validate_extra_args function that uses a whitelist to allow safe yt-dlp flags (e.g., --sleep-interval, --quality) while blacklisting dangerous flags like --exec and --config-location to prevent arbitrary command execution or configuration injection.
[DATA_EXFILTRATION]: The skill incorporates URL validation via a domain whitelist (ALLOWED_DOMAINS) in all scripts to ensure requests are only sent to legitimate YouTube endpoints (e.g., youtube.com, youtu.be). This mitigates potential SSRF risks or data exfiltration to unauthorized domains. The skill only performs network operations via the yt-dlp tool to YouTube's infrastructure.
[INDIRECT_PROMPT_INJECTION]: The skill processes external data in the form of transcripts and video metadata.
Ingestion points: scripts/get_transcript.py (extracts subtitles/captions) and scripts/get_video_info.py (extracts video metadata).
Boundary markers: Not explicitly present in instructions, but the output is intended for agent processing.
Capability inventory: subprocess.run calls to yt-dlp and file writes restricted to .tmp/ directories across all scripts.
Sanitization: scripts/get_transcript.py includes a convert_vtt_to_text function that removes HTML tags, timestamps, and formatting cues, which acts as a basic sanitization layer for the ingested text.
[PRIVILEGE_ESCALATION]: File system operations are restricted to a default .tmp/youtube/ directory. The scripts include validate_output_dir functions that resolve paths and verify they are within the allowed base directory, effectively preventing path traversal attacks and unauthorized writes to sensitive system locations.

youtube-tools