The Agent Skills Directory

[COMMAND_EXECUTION]: The skill instructions and scripts execute several external command-line tools. Scripts scripts/clip.py, scripts/captions.ts, and scripts/verify-bleeps.ts use subprocess.run or Bun.spawnSync to invoke yt-dlp, ffmpeg, ffprobe, and diffusion. SKILL.md provides instructions for the agent to manually execute these tools with user-provided parameters.\n- [EXTERNAL_DOWNLOADS]: The skill downloads content from external sources. yt-dlp is used to fetch video stream URLs and metadata from YouTube. scripts/clip.py uses urllib.request to download specific byte ranges of video and audio streams. The skill also suggests using yt-dlp -U to update the tool, which downloads and installs code from a remote server.\n- [DYNAMIC_EXECUTION]: The skill uses dynamic code loading mechanisms. scripts/captions.ts and scripts/verify-bleeps.ts both use import(pathToFileURL(...)) to load local configuration files (segments.ts and bleeps.ts) from a computed path based on the project directory argument.\n- [INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection through external data processing. \n
Ingestion points: The skill reads YouTube auto-captions (json3 format) and local documentation files (decisions.md). \n
Boundary markers: No explicit delimiters or instructions are used to prevent the agent from obeying commands embedded in these data sources. \n
Capability inventory: The environment allows for file system writes, network requests, and arbitrary command execution. \n
Sanitization: There is no sanitization or validation of the ingested text to filter out potential prompt injection attacks.\n- [DATA_EXFILTRATION]: The skill references absolute file paths on the local system. SKILL.md contains hardcoded paths to a specific user's directory structure (C:\Users\DavidOdunjo\Codebase\YouTube\... and C:\Users\DavidOdunjo\Videos\TheShortlist\...). While these appear to be configuration for the author's environment, they expose internal directory structures.\n- [REMOTE_CODE_EXECUTION]: The skill instructions suggest using yt-dlp -U to update the tool, which involves downloading and executing new code from a remote server, constituting a remote code execution pattern.

clipping-streamer-shorts