The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill fetches video details, including titles and descriptions, from YouTube via an external API. This untrusted data is passed to the agent without sanitization or boundary markers, which could allow malicious content to influence the agent's behavior.
Ingestion points: The script scripts/get_youtube_video.sh fetches data using curl from the Frevana API.
Boundary markers: None; the raw JSON response is printed directly to stdout for the agent to consume.
Capability inventory: The script can write files and create directories if the --output flag is provided.
Sanitization: The script validates that the API response is valid JSON but does not sanitize or filter the text content within the JSON fields.
[COMMAND_EXECUTION]: The script includes an --output parameter that allows the agent or user to specify a file path. The script then executes mkdir -p and cp to write the API response to that location.
[DYNAMIC_EXECUTION]: The bash script uses python3 - to execute inline Python code for argument parsing and JSON structure validation. This logic is internal to the script and is used for data handling.

youtube-video