The Agent Skills Directory

[DYNAMIC_EXECUTION]: The script scripts/make-words.ts utilizes await import() to load a module from a path constructed from the projectArg command-line argument, enabling potential execution of untrusted local code.- [COMMAND_EXECUTION]: The skill relies on shell execution of several tools including yt-dlp, python, bun, and diffusion.cmd to handle video downloading, transcription, and project management.- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to perform pip install faster-whisper and download a transcription model (~145 MB). It also fetches video data from external YouTube URLs using yt-dlp.- [DATA_EXFILTRATION]: The skill instructions contain hardcoded access to specific local user directories (e.g., C:\Users\DavidOdunjo\...), exposing the system's directory structure and local project documentation.- [INDIRECT_PROMPT_INJECTION]: Untrusted transcription data from YouTube or Whisper is ingested and processed. While basic filtering for markers is present in scripts/make-words.ts, the lack of robust sanitization for spoken content could allow instructions to be written into project configuration files like words.ts.

clipping-single-moment-shorts