The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses curl to perform multiple network operations, including authentication, data submission, polling, and file downloading.
[DATA_EXFILTRATION]: The skill sends potentially sensitive information to an untrusted domain (tubeify.xyz).
Evidence: The TUBEIFY_WALLET environment variable and user-provided video_url are transmitted via POST requests to https://tubeify.xyz/index.php and https://tubeify.xyz/process.php.
[INDIRECT_PROMPT_INJECTION]: The skill demonstrates an attack surface for indirect prompt injection by processing data from an external source.
Ingestion points: The skill reads the download_url from the JSON response of https://tubeify.xyz/status.php and the initial video_url provided by the user.
Boundary markers: None present; the agent is instructed to read the URL directly from the response body.
Capability inventory: The skill uses curl to download files and perform network requests.
Sanitization: No sanitization or validation of the returned download_url is performed before it is passed to a shell command.
[EXTERNAL_DOWNLOADS]: The skill downloads content from an unverified external source and saves it to the local file system.
Evidence: curl -o edited_video.mp4 "<download_url>" downloads a file from a URL provided by the external API.

tubeify