The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes system binaries including ffmpeg, ffprobe, and yt-dlp to download and process video files. All command execution is performed using subprocess.run with list-based arguments, ensuring that user-provided URLs or file paths are correctly handled and preventing shell injection attacks.
[EXTERNAL_DOWNLOADS]: The skill downloads content from external sources via yt-dlp as its primary function. It also communicates with established transcription services (Groq, OpenAI) and a vendor-managed proxy to perform audio-to-text conversion. These network operations are transparently documented and use secure HTTPS connections.
[PROMPT_INJECTION]: The skill handles untrusted data from video subtitles. It implements defensive measures against indirect prompt injection by sanitizing VTT tags using regex and wrapping the final transcript in markdown code blocks (triple backticks) to maintain clear boundaries for the AI agent.
[CREDENTIALS_UNSAFE]: Secret management for API keys is handled securely. The skill reads keys from environment variables or a local configuration file (~/.config/watch/.env) with restricted file permissions (0600). The setup.py script specifically checks for and warns about unsafe file permissions, demonstrating a high degree of security awareness.

watch