dym-nuwa-skill-helper-scripts-cli
Pass
Audited by Gen Agent Trust Hub on Oct 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill is designed to run four specific shell and Python scripts (
download_subtitles.sh,srt_to_transcript.py,merge_research.py, andquality_check.py) to perform local file processing and analysis. - [EXTERNAL_DOWNLOADS]: The skill uses the well-known utility
yt-dlpto download subtitle data from YouTube. It provides instructions to install this tool via standard package managers like Homebrew or pipx if it is not already present on the system. - [INDIRECT_PROMPT_INJECTION]: The
srt_to_transcript.pyscript processes external data (YouTube subtitles) by removing timestamps and HTML tags. While this represents a data ingestion surface, the script is a text-cleaning utility and does not execute instructions contained within the data. - [METADATA_POISONING]: The
quality_check.pyscript performs automated checks on the skill's ownSKILL.mdfile using regex patterns to verify the presence of specific sections and keywords, serving as a formatting validator.
Audit Metadata