The Agent Skills Directory

[DATA_EXFILTRATION]: The skill accesses sensitive local browser directories to retrieve authentication cookies.
The detect_browser_profile function in scripts/download_bilibili.py searches for profile roots in ~/.config/chromium, ~/.config/google-chrome, and ~/snap/chromium/common/chromium.
These profiles are used to facilitate authenticated requests to Bilibili, which involves reading local browser data.
[COMMAND_EXECUTION]: The skill executes external command-line tools to perform its primary tasks.
It uses subprocess.run to call yt-dlp with a list of arguments including user-provided URLs and dynamically generated file paths.
[EXTERNAL_DOWNLOADS]: The skill communicates with external domains to retrieve media and metadata.
It performs network requests to b23.tv and bilibili.com (both well-known services) to resolve short links and download video artifacts.
[PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection via untrusted metadata from the media platform.
Ingestion points: External video titles, descriptions, and metadata sidecars are downloaded via yt-dlp from Bilibili.
Boundary markers: Absent; the content is saved directly to files like .info.json and .txt without markers or warnings.
Capability inventory: The skill has the capability to execute shell commands via subprocess.run.
Sanitization: None; the external strings are processed and stored without filtering for malicious instructions.

download-bilibili-video