The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The script Tools/transcribe.py contains logic to automatically install the google-genai library via pip if it is not present in the environment. Performing unverified package installations during script execution is a security risk.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection. It processes untrusted text from video subtitles or audio (via URLs or files) and passes it directly into LLM prompts in Workflows/Extract.md for summarization. The lack of strict boundary markers or instructions to ignore embedded commands allows an attacker to control the agent's behavior through video content.
Ingestion points: Audio and subtitle data from external URLs and local files processed in Tools/transcribe.py.
Boundary markers: Uses weak markers like [文字稿内容] without explicit delimiters or safety instructions.
Capability inventory: Subprocess execution (yt-dlp, ffmpeg, pip), file system access (Downloads and configuration directories), and network requests.
Sanitization: No input sanitization or filtering is performed on the extracted transcript text.
[COMMAND_EXECUTION]: The skill uses subprocess.run to call system utilities such as yt-dlp and ffmpeg. While it uses argument lists to prevent basic shell injection, it introduces a dependency on external binaries and executes them with user-provided paths.
[EXTERNAL_DOWNLOADS]: The core functionality relies on downloading media and metadata from external platforms like YouTube and Bilibili using yt-dlp.
[DATA_EXFILTRATION]: SKILL.md instructs the agent to send a JSON payload to http://localhost:8888/notify using curl. This creates an undocumented local communication channel that notifies a local service of the skill's execution status.

VideoTranscribe