The Agent Skills Directory

[DATA_EXFILTRATION]: The title.py script allows an attacker to specify an arbitrary file path as an argument. The script reads every line of the specified file and prints it to the console as part of its analysis output. This can be exploited to exfiltrate sensitive files such as ~/.ssh/id_rsa, .env files, or system configurations by deceiving the agent into analyzing them as 'title lists'.
[COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands (python3 title.py --title "...") using strings provided by the user. If the agent does not properly sanitize these inputs before invoking the shell, it could lead to arbitrary command injection on the host system.
[INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process external content to establish a 'voice' profile, including transcribing user-provided videos and reading the ~/.claude/youtube/voice.md file. These data sources are untrusted and could contain malicious instructions that hijack the agent's logic during the title generation process.
Ingestion points: SKILL.md instructions for reading ~/.claude/youtube/voice.md and transcribing user-provided video URLs.
Boundary markers: No delimiters or warnings to ignore embedded instructions are present in the prompt instructions.
Capability inventory: The skill possesses the ability to execute shell commands and read/write local files.
Sanitization: There is no evidence of filtering or sanitization of the content retrieved from video transcripts or the voice profile before it is interpolated into the agent's context.

yt-package