The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run within scripts/tikhub_api.py and scripts/extract_video_transcript.py to call the macOS security command. This is used exclusively for retrieving API keys from the system keychain in a secure manner.
[DATA_EXPOSURE]: The skill reads and writes service credentials to a local configuration file located at ~/.config/dbs/API_Keys.md. It implements best practices by restricting file permissions to 0o600 (owner-only access) and providing a script (scripts/configure_api_key.py) that uses getpass to read credentials without echoing them to the terminal.
[EXTERNAL_DOWNLOADS]: The skill communicates with tikhub.io and qingdou.vip APIs to perform its primary function of fetching video metadata and transcripts. These are external service dependencies required for the skill to operate.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data in the form of short video URLs and sharing text from external platforms.
Ingestion points: User-supplied links and text are ingested via command-line arguments or standard input in scripts/extract_video.py.
Boundary markers: None explicitly defined in the scripts, as the input is treated as a single data parameter for API submission.
Capability inventory: The skill possesses network communication capabilities and file write permissions to save results.
Sanitization: The scripts/extract_video_transcript.py script includes a safe_name function that uses regular expressions to strip illegal characters (such as path separators) and enforces length limits, effectively preventing path traversal or directory manipulation attacks.

dbs-video-extract