The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill downloads and executes the uv toolchain from astral.sh (a well-known service) and fetches the mpt_agent.py helper script and project archive from the author's official GitHub repository (github.com/harry0703). These sources are recognized as trusted or well-known.
[COMMAND_EXECUTION]: The skill utilizes subprocess.run with argument lists to invoke the uv package manager and the internal MoneyPrinterTurbo CLI. This implementation avoids shell-based command injection vulnerabilities.
[PRIVILEGE_ESCALATION]: In Windows environments, the skill employs the ExecutionPolicy ByPass flag in PowerShell to permit the automated installation of the uv tool.
[INDIRECT_PROMPT_INJECTION]: The skill presents an attack surface for indirect prompt injection through user-supplied video topics or script content.
Ingestion points: The subject parameter (video topic) is accepted as user input and passed to execution scripts via command-line arguments.
Boundary markers: While the input is whitespace-stripped, it lacks explicit delimiters or encapsulation to prevent potential injection attempts within the CLI tool's logic.
Capability inventory: The skill possesses capabilities for filesystem writes (config.toml, .agent-logs), network requests (for validation and downloading updates), and subprocess execution.
Sanitization: Only basic string stripping is performed on the user-provided subject before processing.
[CREDENTIALS_UNSAFE]: The skill manages API keys for various LLM and media providers by reading from and writing to a local config.toml file. The instructions include explicit directives for the AI agent to protect these credentials and avoid leaking them in logs or output.

moneyprinterturbo-video