The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The script scripts/_utility__download_ffmpeg.sh downloads a pre-compiled ffmpeg binary from https://ffmpeg.martin-riedl.de/redirect/latest/macos/${arch}/snapshot/ffmpeg.zip. This domain is not associated with a well-known trusted organization or the official ffmpeg project.
[CREDENTIALS_UNSAFE]: The skill automatically accesses browser cookies to bypass YouTube restrictions. The scripts/audio.sh script searches for and attempts to use authentication cookies from Chrome (including all detected profiles), Firefox, Safari, Edge, and Brave. This involves accessing sensitive application data directories (e.g., ~/Library/Application Support/Google/Chrome or ~/.config/google-chrome).
[REMOTE_CODE_EXECUTION]: Several utility scripts (_utility__download_*.sh and _utility__build_*.sh) download and prepare executable binaries from the internet. This includes fetching yt-dlp, jq, and ffmpeg source or binaries. Although many sources like GitHub and ffmpeg.org are reputable, the pattern of downloading, making executable, and then running code from external URLs is a significant security vector.
[COMMAND_EXECUTION]: The main script scripts/audio.sh executes shell commands and external binaries with arguments derived from user input (YouTube URL). It also uses eval logic implicitly via source of utility scripts and execution of the downloaded tools.
[PROMPT_INJECTION]: The skill processes metadata from external YouTube videos (titles, channel names) via yt-dlp. This data is then used in the agent's context. Evidence: 1. Ingestion point: scripts/audio.sh via fetch_metadata. 2. Boundary markers: Absent in yt-dlp metadata printing. 3. Capability: File system writes, deletions, and network operations across all scripts. 4. Sanitization: Uses jq for JSON formatting, but does not sanitize the content for potential indirect prompt injection against the agent.

mk-youtube-get-audio