The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes transcription data (subtitles) fetched from external YouTube URLs, which are not under the user's or agent's control.
Ingestion points: The scripts/transcript.sh script uses yt-dlp to download subtitles from an external URL.
Boundary markers: There are no explicit delimiters or instructions provided to the agent to distinguish between the transcript content and instructions, nor warnings to ignore embedded commands within the text.
Capability inventory: The skill executes shell scripts and Node.js commands, providing a path for potential exploitation if the agent is influenced by malicious text in the captions.
Sanitization: While the awk script removes HTML-like tags (e.g., <c>), it does not sanitize the text for natural language instructions that could hijack the summary generation process.
[COMMAND_EXECUTION]: The skill's operational instructions in SKILL.md rely on interpolating user input into a shell command.
The pattern bash skills/youtube/scripts/transcript.sh '<youtube-url>' is vulnerable to command injection if the agent does not escape single quotes within the URL string (e.g., a URL like ' ; touch /tmp/pwned ; ').
The skill also executes a local Node.js script scripts/run-state-check.js which is referenced but not provided in the analyzed file set.

youtube