The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads ML model weights (config.json, weights.npz) from hf-mirror.com (a common mirror for Hugging Face) using the fetch-large-v3.sh script. These files are required for the large-v3 model and are treated as data by the transcription engine. As Hugging Face is a well-known service, these downloads are considered legitimate.
[COMMAND_EXECUTION]: The skill executes external CLI tools including ffmpeg, yt-dlp, and ffprobe to process media files and extract metadata. These operations are implemented using safe patterns, such as quoted variables in bash scripts and list-based arguments in Python's subprocess.run, which effectively prevents command injection from user-provided file names or URLs.
[PROMPT_INJECTION]: The skill processes untrusted data from external URLs or uploaded files to generate transcripts. This presents an indirect prompt injection surface where spoken instructions in the audio could attempt to influence the agent's behavior during subsequent processing of the transcript.
Ingestion points: Audio/video file paths or URLs provided to transcribe.sh.
Boundary markers: None implemented for the generated transcript text.
Capability inventory: Subprocess calls to ffmpeg, yt-dlp, and ffprobe (scripts/transcribe.sh, scripts/verify_transcript.py).
Sanitization: None; the raw transcript is output for further use.

generate-transcript