The Agent Skills Directory

[COMMAND_EXECUTION]: The skill relies on shell commands to perform its core functions. It invokes yt-dlp, curl, ffmpeg, ffprobe, and python3 to extract, download, convert, and process media data. These commands use variables such as VIDEO_URL, EPISODE_URL, and AUDIO_URL which are derived from user input.
[INDIRECT_PROMPT_INJECTION]: This skill possesses an attack surface for indirect prompt injection as it ingests data from external sources. It fetches subtitles via yt-dlp and generates transcripts via the Whisper API, then uses this untrusted text to generate summaries. The skill lacks explicit boundary markers or sanitization logic to prevent instructions embedded within the media content from influencing the final summary output.
Ingestion points: External subtitles (VTT files) and Whisper transcription JSON results are read into the agent's context.
Boundary markers: None identified in the provided instructions for the summarization step.
Capability inventory: The skill has access to file system operations (rm, stat, ls), network operations (curl), and media processing tools (ffmpeg, yt-dlp).
Sanitization: No filtering or sanitization of the extracted text is performed before summarization.
[EXTERNAL_DOWNLOADS]: The skill downloads media files and metadata from various established platforms, including YouTube, Bilibili, and Apple Podcasts. It also fetches audio streams from CDNs like media.xyzcdn.net and communicates with the api.groq.com endpoint for transcription services.
[CREDENTIALS_UNSAFE]: The skill requires a GROQ_API_KEY for its transcription functionality. It instructs the agent to use an environment variable for authentication when calling the Groq API via curl.

video