The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads Python packages openai-whisper, yt-dlp, and torch from official package registries (PyPI) and the official PyTorch CUDA index during setup.
Evidence: uv pip install --python whisper-env torch --index-url https://download.pytorch.org/whl/cu124 in SKILL.md.
[EXTERNAL_DOWNLOADS]: The skill downloads system tools from well-known sources (Astral, winget, Homebrew, apt) to ensure proper functioning.
Evidence: curl -LsSf https://astral.sh/uv/install.sh | sh in references/install.md.
[COMMAND_EXECUTION]: The script scripts/transcribe.py executes yt-dlp and whisper binaries via subprocess.run to handle audio/video processing. These calls use list-based arguments which mitigate shell injection risks.
Evidence: subprocess.run([yt_dlp, source, "-o", "yt_tmp.%(ext)s", "--no-playlist"], ...) in scripts/transcribe.py.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (video/audio from URLs or local files) through transcription.
Ingestion points: URL or file path provided to scripts/transcribe.py.
Boundary markers: None explicitly defined for the resulting text, but the disable-model-invocation: true flag in the frontmatter prevents the agent from automatically acting on the transcript output, significantly reducing injection risk.
Capability inventory: File system writes (transcript file), network access (via yt-dlp), and subprocess execution.
Sanitization: None on the transcript content, though it is output as a plain .txt file.

transcribe-video