The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The scripts/media_crawler.py script contains a setup-mediacrawler command that clones a specific version of an external repository (https://github.com/NanmiCoder/MediaCrawler.git) and installs its dependencies using uv sync. This code is subsequently executed to perform media extraction.
[COMMAND_EXECUTION]: The skill makes extensive use of the subprocess module to execute system commands.
In scripts/media_crawler.py, it executes git, uv, aria2c, curl, and ffprobe to manage dependencies and download media.
In scripts/authorize_yuanbao.py, it uses the macOS security utility to write credentials to the system Keychain (security add-generic-password).
[DYNAMIC_EXECUTION]: The scripts/media_crawler.py script generates a Python code string at runtime and executes it via uv run python -c. This generated code dynamically configures and launches the external MediaCrawler module.
[DATA_EXFILTRATION]: The skill includes a hardcoded URL for a third-party resolution service (https://sph.litao.workers.dev/api/fetch_video_profile). While the documentation states this is opt-in (--allow-public-resolver), enabling it sends user-provided social media URLs to an external, non-vendor-controlled service.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes untrusted content from external platforms.
Ingestion points: External URLs and fetched platform metadata (titles, descriptions, author names) in scripts/media_crawler.py.
Boundary markers: None; metadata is processed and returned in a structured JSON report.
Capability inventory: File system writes, network requests, and shell command execution (curl, aria2c, git).
Sanitization: The skill uses safe_filename to sanitize titles for file operations and safe_url to redact query parameters in logs.

lov-media-crawler