The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/get_transcript.py is vulnerable to argument injection. When calling the yt-dlp utility via subprocess.run, the user-provided URL is appended to the command list without a positional argument separator (--). A malicious input starting with a dash (e.g., --exec "command") will be interpreted by yt-dlp as a configuration flag rather than a URL, allowing for arbitrary command execution.
[EXTERNAL_DOWNLOADS]: The skill relies on the external yt-dlp binary. The SKILL.md metadata provides instructions to install this dependency via pip or brew. While yt-dlp is a legitimate tool, its insecure invocation within this skill creates a significant security risk.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it ingests untrusted subtitle data from external YouTube videos.
Ingestion points: Video transcripts are fetched and read into the agent context via scripts/get_transcript.py.
Boundary markers: There are no delimiters or specific instructions to the agent to ignore or isolate instructions found within the transcript text.
Capability inventory: The skill has the capability to execute shell commands using subprocess.run (found in scripts/get_transcript.py).
Sanitization: The clean_vtt function removes technical metadata and HTML-like tags but does not sanitize the text content for potential malicious instructions or prompt injection attacks.

youtube-watcher