The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (videos and subtitles) from URLs or local files. This creates an attack surface for indirect prompt injection. However, the skill incorporates security best practices by including explicit instructions in SKILL.md to treat any instructions found within the video content solely as data and not as directives to the agent.
[COMMAND_EXECUTION]: The bundled Python script (scripts/view_video.py) executes external utilities (yt-dlp, ffmpeg, ffprobe) to perform its core functions. The script uses safe subprocess.run calls with argument lists rather than shell strings, preventing typical command injection vulnerabilities. The instructions also provide guidance for updating yt-dlp through its official repository to ensure reliable operation.

view-video