The Agent Skills Directory

[PRIVILEGE_ESCALATION]: The scripts/install-toolkit.sh script uses sudo to install system packages like aria2, wget, ffmpeg, and jq on Linux distributions, granting the script elevated administrative access during installation.
[CREDENTIALS_UNSAFE]: The scripts/dl-video.sh script invokes yt-dlp with the --cookies-from-browser flag, which attempts to read and extract authentication tokens and session cookies from local browser profiles (Chrome, Firefox, Edge). This is used to bypass site-specific restrictions but involves accessing highly sensitive private data.
[EXTERNAL_DOWNLOADS]: The skill installs numerous third-party utilities from public package registries, including pip, npm, and brew. This involves downloading and executing code from external sources maintained by various third-party developers.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted user-supplied data, such as URLs and search queries, which are passed to external tools that parse metadata from third-party websites. This creates a surface where malicious content on those sites could potentially influence the agent's behavior.
[COMMAND_EXECUTION]: The skill relies on several bash scripts to automate complex command-line workflows involving media extraction, network requests, and system-level operations.

download-anything