The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill generates and executes a script (transcribe.py) that disables SSL certificate verification using ssl._create_unverified_context(). This allows the script to fetch models without verifying the server's identity, exposing the system to potential Man-in-the-Middle (MitM) attacks.
[COMMAND_EXECUTION]: The execution of python transcribe.py "<path_to_video>" is potentially unsafe. If a video filename contains shell-sensitive characters such as double quotes, it could lead to arbitrary command execution on the host system.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection. It ingests untrusted text from video transcriptions (via Whisper) and includes it in the prompt for generating YouTube descriptions without using boundary markers or sanitization. An attacker could embed instructions in the video audio to manipulate the generated description.

youtube-transcribe