The Agent Skills Directory

[COMMAND_EXECUTION]: The scripts/yt-search.sh script is vulnerable to shell command injection. User-supplied search queries are concatenated and then interpolated into a shell command string: yt-dlp "ytsearch${FETCH_COUNT}:${QUERY}". Because the $QUERY variable is evaluated within double quotes by the bash shell, any command substitutions such as $(...) or backticks present in the user's input will be executed on the host system before the yt-dlp process starts.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from YouTube search results which could be crafted to include malicious instructions for the AI agent.
Ingestion points: The output of scripts/yt-search.sh, specifically video titles, channel names, and engagement metrics extracted from YouTube via yt-dlp.
Boundary markers: Absent. The search results are printed as plain text without clear delimiters or instructions for the agent to ignore embedded commands.
Capability inventory: The agent is instructed to run the bash script, and the environment has network access via yt-dlp and calculation capabilities via bc.
Sanitization: Absent. The script uses jq to extract raw strings from the JSON data returned by yt-dlp and prints them directly to stdout.
[METADATA_POISONING]: The SKILL.md file contains a "Gotchas" section that incorrectly describes the skill's technical constraints. It references YouTube Data API v3 concepts such as "Quota units" and specific API parameters like regionCode, even though the tool actually uses the yt-dlp scraping utility. This discrepancy is misleading regarding the tool's actual operational behavior and resource limitations.

youtube-search