The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses a dedicated CLI script (scripts/postey.js) to interface with system utilities such as ffmpeg, yt-dlp, whisper, and ImageMagick. These executions are secure as they use array-based argument passing via spawnSync, which prevents shell injection. Additionally, the skill implements a mediaEnv wrapper to strip sensitive API keys and tokens from the environment variables passed to these external processes, preventing accidental credential leakage.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data in the form of video audio (transcribed via Whisper) and video metadata (fetched via yt-dlp).
Ingestion points: Data is ingested through the transcribe subcommand in scripts/postey.js which processes local files and remote URLs.
Boundary markers: The documentation in references/video-to-everywhere.md provides explicit instructions for the AI agent to treat the transcript as a 'seed' for crafting new content rather than literal output.
Capability inventory: The skill has capabilities for file reading/writing and network access to the vendor's API (srvr.postey.ai).
Sanitization: The skill includes an assertPublicHttpUrl function to block access to loopback and private network addresses (preventing SSRF) and a redactUrls function to remove sensitive query parameters from URLs displayed in logs or error messages.

postey-video