The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses yt-dlp and ffmpeg to download and process video files. It explicitly instructs the agent to use safe execution patterns (e.g., Python's subprocess.run([...], shell=False)) to prevent command injection from untrusted metadata like video titles.
[EXTERNAL_DOWNLOADS]: The skill downloads media and metadata from external platforms including YouTube, TikTok, Twitter/X, Instagram, and Facebook. It implements an allowlist of HTTPS hosts and restricts the egress network to prevent unauthorized data exfiltration or internal network scanning.
[PROMPT_INJECTION]: The skill processes untrusted content (titles, descriptions, captions) from social media pages. This presents a risk of indirect prompt injection where an attacker could embed instructions in a video description to influence the agent's behavior. The skill mitigates this with an 'untrusted-content-contract' requiring delimiters and explicitly forbidding external content from authorizing actions.
[SAFE_PRACTICES]: The skill recommends using a requirements.lock with hashes for Python dependencies and advises against automatic software installation, favoring user-mediated OS package managers for tools like ffmpeg.

video-download