The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill provides an installation command for the uv package manager via a remote script (https://astral.sh/uv/install.sh) piped to a shell. This is a standard installation method for this well-known developer tool.
[EXTERNAL_DOWNLOADS]: The skill utilizes yt-dlp to fetch metadata and subtitle files from YouTube. It also facilitates the dynamic installation and execution of the openai-whisper package and its models from PyPI/OpenAI for transcription fallback.
[COMMAND_EXECUTION]: The skill uses the Bash tool to orchestrate a workflow involving file system operations (mktemp, find, rm), text processing (wc), and external CLI tools (yt-dlp, whisper).
[PROMPT_INJECTION]: The skill processes untrusted input in the form of YouTube URLs and video titles.
Ingestion points: User-provided YouTube URLs in SKILL.md and video titles retrieved via yt-dlp.
Boundary markers: The skill uses a regex check for YouTube domains and a tapestry-validate-url utility to restrict input.
Capability inventory: Subprocess execution via Bash tool for downloading and processing; Write tool for saving transcripts.
Sanitization: External video titles are processed through tapestry-sanitize-filename before being used in file operations or shell commands.
[DATA_EXFILTRATION]: Network operations are performed to fetch content from youtube.com and astral.sh. These operations are consistent with the skill's primary purpose of retrieving video transcripts and managing dependencies.

youtube-transcript