The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads and executes external packages from public registries at runtime.
Evidence:
Fetches mcp-video-analyzer@0.7.1 via bunx in scripts/analyze-video.sh.
Fetches yt-dlp==2026.7.4 via uvx in scripts/yt-dlp-uvx.sh.
Fetches openai-whisper==20250625 via uvx in scripts/openai-whisper.sh.
Fetches mlx-whisper==0.4.3 via uvx in scripts/mlx-whisper.sh.
[COMMAND_EXECUTION]: The skill uses a shell orchestrator to execute multiple analysis tools based on user-supplied input.
Evidence:
scripts/analyze-video.sh executes bunx, uvx, and python3 subprocesses.
The $source variable (video URL or path) is passed to the analyzer tool.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external videos which could contain malicious instructions targeting the agent.
Ingestion points: Video metadata (title, duration), transcripts (speech-to-text), and OCR results (on-screen text) are extracted from URLs or local files and written to research.md via scripts/analyze-video.sh.
Boundary markers: The SKILL.md file contains a manual verification instruction: "verify important wording at timestamp/frame before quoting", but no technical boundary markers (delimiters) are used in the generated research artifacts.
Capability inventory: The skill possesses file-write capabilities (transcript.txt, research.md, analysis.json) and subprocess execution via bunx, uvx, and python3.
Sanitization: The Python rendering script in scripts/analyze-video.sh performs basic whitespace cleaning using clean() but does not sanitize for prompt injection markers in the video metadata or extracted text.

video-research