The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes the system security command on macOS to securely retrieve API keys from the user's keychain, which is a standard security practice for managing credentials on that platform.
[DATA_EXFILTRATION]: The skill communicates with TikHub and Qingdou API endpoints (tikhub.io, tikhub.dev, qingdou.vip) to fetch video metadata and transcripts. It follows security best practices by storing credentials in a restricted local file (~/.config/dbs/API_Keys.md with 0600 permissions) and leveraging the macOS keychain. The scripts include logic to redact API keys from error messages and logs, preventing accidental exposure during network operations or debugging.
[INDIRECT_PROMPT_INJECTION]: The skill processes external video transcripts, presenting a potential injection surface.
Ingestion points: Video transcripts are fetched from the Qingdou API in scripts/extract_video_transcript.py.
Boundary markers: The generated Markdown files separate metadata into a YAML frontmatter block and the transcript into a body section under a title header, though they do not include specific safety instructions for downstream agents.
Capability inventory: The skill has capabilities for file writing (path.write_text), network communication (urllib.request), and local command execution for credential retrieval (security command).
Sanitization: Metadata in the Markdown frontmatter is sanitized via JSON serialization, and the transcript text undergoes basic whitespace normalization before storage.

dbs-video-extract