The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes curl, jq, and yt-dlp to fetch and parse video metadata and transcripts. It also uses a Python heredoc to process JSON data into clean text, which is a standard pattern for data transformation within a skill.
[EXTERNAL_DOWNLOADS]: Communicates with deepapi.co to fetch transcript data. This domain is associated with the skill's vendor infrastructure. It also interacts with YouTube via the yt-dlp utility.
[CREDENTIALS_UNSAFE]: Accesses an API key stored in ~/.deepapi/env. This is a recommended practice for local secret management to avoid hardcoding credentials in the skill body.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of YouTube transcripts.
Ingestion points: Transcript text is pulled from the DeepAPI endpoint and yt-dlp output.
Boundary markers: No explicit delimiters are used when saving the transcript to a file.
Capability inventory: The skill can execute shell commands (curl, yt-dlp), write files to the filesystem, and run inline Python scripts.
Sanitization: The Python script uses html.unescape and regex to clean whitespace and HTML entities, though it does not sanitize for potential prompt injection content (treated as a low-risk surface given the use case).

youtube-transcript