The Agent Skills Directory

[SAFE]: The skill implements a robust safety model for YouTube uploads. It requires a dry-run ('plan' command) which generates a deterministic SHA-256 plan ID. This ID must be provided during the execution phase ('publish' command) to ensure that the video content or metadata has not been altered after the user's initial review.
[SAFE]: Credential management follows industry best practices. OAuth tokens and client secrets are stored in a dedicated configuration directory (~/.config/ytshorts/) with filesystem permissions restricted to the current user (mode 0600/0700). The tool explicitly warns against exposing these secrets in chat or logs.
[SAFE]: The skill has zero runtime dependencies, significantly reducing the risk of supply chain attacks. It uses only built-in Node.js modules and relies on the standard ffprobe binary for local media inspection, including safety limits on command output size.
[SAFE]: Network communications are strictly scoped to official Google and YouTube API domains (accounts.google.com, www.googleapis.com) for authentication and resumable video uploads. No unauthorized data exfiltration or third-party tracking was detected.
[SAFE]: The skill provides explicit protection against common pitfalls, such as ensuring "Made for Kids" and "Synthetic Media" declarations are manually provided by the user rather than inferred by the agent.

youtube-shorts-publish