The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill's primary function is to ingest untrusted data from doc sites, YouTube transcripts, and PDFs to generate skill instruction files. This creates a significant surface for indirect prompt injection if a source contains malicious instructions designed to bypass the skill's scanners.
Ingestion points: Web crawlers (ingest_web.py), YouTube fetchers (ingest_youtube.py), and local file converters (ingest_local.py) ingest content into the agent context.
Boundary markers: The skill uses fenced blocks in the review.md brief marked as "untrusted source data" and employs grounding markers (src: id "quote") in authored files to maintain separation between data and instructions.
Capability inventory: The skill has high capabilities, including executing several CLI tools via subprocess and running its own scripts via uv run.
Sanitization: The skill includes a dedicated scan/ package that checks for prompt injection patterns (injection.py), hardcoded secrets (credentials.py), and hidden Unicode characters (unicode.py).
[EXTERNAL_DOWNLOADS]: The skill downloads several machine learning models upon first use from established repositories (Hugging Face or equivalent).
Laya: A local model (approx. 843 MB) used for advisory judgments and ranking.
Whisper: Speech recognition models (0.1-3 GB) used for transcribing YouTube videos without captions.
Docling: Document conversion models (~1 GB) used for PDF and office file conversion.
[COMMAND_EXECUTION]: The skill executes external command-line utilities via the subprocess module to perform document conversion and media processing.
Utilities: It calls ffmpeg for frame extraction, pdftotext for PDF layout extraction, yt-dlp for YouTube metadata, and agent-browser for JavaScript rendering.
Hardening: Command-line calls consistently use the -- delimiter to prevent command injection via malicious URLs (e.g., in listing.py).

anything-to-skill