The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads movie metadata and media files from Internet Archive and subtitle files from OpenSubtitles. These are well-known services and the use is consistent with the skill's primary functionality.
[COMMAND_EXECUTION]: Utilizes shell scripts (pack.sh) and command-line utilities including ffmpeg, ffprobe, yt-dlp, mdfind, and find. These tools are used to process files, transcode video, and locate existing files in the user's home directories (~/Movies, ~/Downloads) and mounted volumes.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests untrusted metadata (titles, years, descriptions) and subtitle content from external APIs, which are then interpolated into shell commands and file paths.
Ingestion points: API responses from Internet Archive (scripts/ia_search.py) and OpenSubtitles (scripts/opensubs.py).
Boundary markers: No explicit boundary markers are used when passing external strings to shell-based tools.
Capability inventory: File system writing, network downloads via curl, and shell command execution via ffmpeg and yt-dlp.
Sanitization: Employs URL encoding in Python and standard shell quoting in Bash scripts to mitigate basic injection, but remain susceptible to sophisticated payload manipulation in metadata.

wjs-fetching-movie