The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill automatically downloads and installs the youtube-transcript package from the npm registry using bun install. The installation targets a local cache directory ~/.cache/codex/youtube-transcript-summary to manage its own dependencies.
[COMMAND_EXECUTION]: The script get_youtube_transcript.sh generates executable Python and Node.js scripts at runtime using shell heredocs. These scripts are used for parsing YouTube URLs and interacting with the YouTube oEmbed and transcript APIs.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted external data (YouTube transcripts) which are then processed by the agent.
Ingestion points: External transcript text is fetched via get_youtube_transcript.sh and injected into the agent's prompt context.
Boundary markers: The script does not wrap the transcript in security delimiters or provide specific instructions to ignore embedded commands.
Capability inventory: While the skill itself is limited to reading, the agent processing this data may have other capabilities (e.g., file writing, network access) that could be triggered by instructions hidden in a transcript.
Sanitization: No filtering or sanitization is performed on the transcript content before it is delivered to the agent.

youtube-transcript-summary