The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/download_video.py contains a self-installation mechanism for its primary dependency. It uses pip to install yt-dlp if it is not detected on the system. This is a common pattern for utility scripts to ensure functionality in different environments.
[COMMAND_EXECUTION]: The skill uses Python's subprocess module to execute yt-dlp and pip. The commands are constructed using lists rather than shell strings, which is a secure practice that prevents shell injection vulnerabilities.
[PROMPT_INJECTION]: The skill has an attack surface for indirect prompt injection as it processes external metadata from YouTube.
Ingestion points: Video metadata (title, uploader) is fetched via yt-dlp --dump-json in scripts/download_video.py and displayed to the user.
Boundary markers: None present; the skill displays external content directly in the console output.
Capability inventory: The skill has file system write access (saving videos) and network access (downloading from YouTube) via the subprocess calls in scripts/download_video.py.
Sanitization: The script relies on the underlying yt-dlp tool to sanitize video titles before using them in filenames, which mitigates path traversal risks.

youtube-downloader