The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute several command-line tools including ffmpeg, whisper, and yt-dlp. While it uses list-based arguments and implements regex-based sanitization for filenames and IDs, these tools process complex, untrusted external media data.
[REMOTE_CODE_EXECUTION]: In scripts/providers/youtube.py, the skill invokes yt-dlp with the --remote-components ejs:github flag. This allows the utility to download and execute code or plugins from GitHub repositories at runtime, which is a mechanism for dynamic code execution from external sources.
[CREDENTIALS_UNSAFE]: The providers for Bilibili, Douyin, YouTube, and Xiaohongshu all include fallback commands that use --cookies-from-browser chrome. This allows yt-dlp to read sensitive session cookies from the user's local browser to authenticate with video platforms and bypass anti-bot measures.
[EXTERNAL_DOWNLOADS]: The skill downloads content from various video platforms (Bilibili, Douyin, YouTube, Xiaohongshu). Additionally, it interacts with SiliconFlow's API (api.siliconflow.cn) to perform audio transcription, which involve uploading local audio artifacts to an external service provider.
[DATA_EXFILTRATION]: When the siliconflow ASR backend is used, the skill extracts audio from video files and sends the resulting audio data to SiliconFlow's transcription endpoint via a multipart HTTP POST request.

video-downloader