The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/get_transcript.py contains a critical argument injection vulnerability. The user-provided url argument is passed directly as an element in a command list for subprocess.run. Because the script does not use the -- separator to signal the end of command-line options, a malicious string starting with a dash (such as --exec "id") will be processed as a flag by the yt-dlp binary, leading to arbitrary command execution on the host system.
[REMOTE_CODE_EXECUTION]: The argument injection in the yt-dlp call allows for remote code execution by leveraging flags like --exec or --post-processor-args, which can run arbitrary shell commands with the agent's privileges.
[EXTERNAL_DOWNLOADS]: Fetches transcript data from YouTube's servers using the well-known yt-dlp utility.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection because it processes untrusted data from external YouTube transcripts. This surface can be used by an attacker to embed instructions in video captions to influence the agent's behavior during summarization or analysis.
Ingestion points: The scripts/get_transcript.py script fetches text from external sources via yt-dlp.
Boundary markers: No explicit delimiters or boundary markers are present in the script's output to separate untrusted transcript text from system instructions.
Capability inventory: The agent uses the fetched transcript content to perform summarization and content extraction tasks.
Sanitization: The clean_vtt function removes technical VTT timestamps and metadata but does not perform any semantic filtering or validation of the text content.

youtube-watcher-hardened