The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill fetches video content and metadata from remote URLs using the yt-dlp utility as part of its core functionality.
[COMMAND_EXECUTION]: Local binaries including ffmpeg, ffprobe, and yt-dlp are invoked to process media files. These calls are implemented using argument lists to prevent shell injection vulnerabilities. On macOS, the skill can use brew to install these dependencies.
[DATA_EXFILTRATION]: Audio tracks from videos are sent to Groq or OpenAI Whisper APIs for transcription. This process is necessary for the skill's purpose and is clearly disclosed in the security documentation.
[CREDENTIALS_UNSAFE]: Whisper API keys are managed through a local configuration file (~/.config/watch/.env). The skill ensures these credentials are protected by setting file permissions to 0600.
[PROMPT_INJECTION]: The skill ingests untrusted text data from captions and generated transcripts.
Ingestion points: Captions from yt-dlp and transcripts from APIs are loaded into the agent context via the output of scripts/watch.py.
Boundary markers: Transcript data is enclosed in markdown code blocks to separate it from agent instructions.
Capability inventory: The agent has access to Bash (executing ffmpeg, yt-dlp) and network communication via the transcription scripts.
Sanitization: The skill performs technical cleaning of subtitle tags in scripts/transcribe.py but does not filter the natural language content.

watch