The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill instructions include patterns for downloading and executing remote shell scripts.
Evidence: curl -fsSL https://treg.to/install.sh | sh is used to install the Treg CLI.
Evidence: Fetches the Deno installer from Deno's official domain via curl -fsSL https://deno.land/install.sh | sh (Deno is a well-known runtime service).
[INDIRECT_PROMPT_INJECTION]: The skill establishes a workflow that processes untrusted external content (video transcripts) to create a user profile.
Ingestion points: Video transcripts are pulled via yt-dlp from YouTube, TikTok, and Instagram URLs (documented in SKILL.md).
Boundary markers: No delimiters or "ignore embedded instructions" warnings are used when the agent processes transcript data.
Capability inventory: The skill suite uses shell execution for ffmpeg, yt-dlp, node, and treg commands.
Sanitization: No sanitization or validation of the transcript text is mentioned before the agent analyzes it.
[PRIVILEGE_ESCALATION]: The skill provides commands that require root or administrative privileges to install system-level dependencies.
Evidence: sudo apt install ffmpeg and sudo apt install git build-essential in SKILL.md.
[COMMAND_EXECUTION]: The skill guides the user to modify .claude/settings.json to grant the agent pre-approved execution rights for several command patterns, increasing autonomy.
Pre-approved patterns include Bash(yt-dlp *), Bash(ffmpeg *), Bash(ffprobe *), Bash(npx remotion *), and Bash(node sub.mjs *).
[EXTERNAL_DOWNLOADS]: The skill initiates downloads of third-party packages from official registries and organizations.
Evidence: Downloads the Codex CLI from OpenAI's official NPM package (@openai/codex).
Evidence: Installs the yt-dlp package via pipx.

studio-setup