The Agent Skills Directory

[COMMAND_EXECUTION]: The skill invokes external command-line tools such as yt-dlp, ffmpeg, and whisper to perform its media processing tasks. These tools are executed using subprocess.run with argument lists rather than shell strings, which is a secure practice that prevents shell injection attacks.\n- [EXTERNAL_DOWNLOADS]: The skill facilitates the downloading of media and metadata from various video platforms. The YouTube provider specifically utilizes yt-dlp's capability to fetch updated extractor components from GitHub (ejs:github) to maintain functionality as platform structures change.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted text data (titles, descriptions, captions) from video platforms and generates transcripts from audio content. If these text outputs are used as inputs for subsequent agent actions without proper sanitization or boundary markers, they could be exploited to influence agent behavior.\n
Ingestion points: Untrusted platform metadata and ASR transcripts are saved as plain text in post_caption.txt and transcript.txt.\n
Boundary markers: The skill does not insert delimiters or 'ignore' instructions around the ingested content to signal that the data is untrusted.\n
Capability inventory: The skill possesses capabilities to write files and execute downloader subprocesses, defining the potential reach of an injection vulnerability.\n
Sanitization: No sanitization, validation, or filtering is performed on the text extracted from the platforms or the transcripts generated from audio content.

video-downloader