The Agent Skills Directory

[COMMAND_EXECUTION]: The skill constructs shell commands using unvalidated input.
The command uvx yt-dlp --get-title "<youtube_url>" in SKILL.md directly incorporates user input into a shell command, which can lead to command injection if the URL contains shell metacharacters.
The skill uses git commit -m "Add <short topic> note..." where <short topic> is derived from external metadata, providing a secondary vector for command injection.
[DATA_EXFILTRATION]: The skill accesses sensitive local file system paths.
In SKILL.md, the workflow hardcodes and writes to /Users/mtm/Documents/Obsidian Vault/. Accessing specific user home directory subfolders is a high-severity privacy and exposure finding.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data that influences system actions.
Ingestion points: Video titles, channel names, and summaries are fetched from YouTube via yt-dlp and WebFetch (SKILL.md).
Boundary markers: No delimiters or instructions are used to isolate external content from the agent's logic.
Capability inventory: The skill has shell execution (yt-dlp, git) and local file writing capabilities (SKILL.md).
Sanitization: While some characters are stripped for filenames, no sanitization is performed on the data interpolated into git commit messages.

youtube-ingest