The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses yt-dlp via the Bash tool to download video metadata and subtitles. This is the primary purpose of the skill and is handled using standard CLI arguments (--skip-download, --write-subs).
[EXTERNAL_DOWNLOADS]: The skill downloads subtitle files (.vtt) from video hosting platforms (primarily YouTube). These downloads are restricted to subtitle text data and do not include executable code.
[DYNAMIC_EXECUTION]: The skill includes a local helper script vtt_to_paragraph.py to process subtitle files. The script uses Python's standard library only (argparse, re, sys, pathlib) and does not perform any dangerous operations like eval() or exec(). It safely reads the local .vtt file and outputs text to stdout or a file.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data (video subtitles). While subtitles could theoretically contain malicious instructions, the skill handles them as data for cleaning and formatting, and the output is intended for the agent's context as a transcript. The Python script performs sanitization by removing HTML-like tags (<c>) and deduplicating rolling captions, which reduces the surface area for injection.

video-transcript