The Agent Skills Directory

[COMMAND_EXECUTION]: The skill bundle includes a 'Tier 2' advanced publishing feature implemented in lib/backend_selector.py. This feature allows users to configure a custom uploader command via the YOUTUBE_SKILLS_CUSTOM_POSTER environment variable. The code uses subprocess.run() to execute this user-defined command, passing the publishing payload as JSON to its standard input. While this is a documented extension point, it provides a mechanism for local command execution.
[INDIRECT_PROMPT_INJECTION]: The yt-audience-insights skill (defined in skills/yt-audience-insights/SKILL.md) is designed to ingest and analyze untrusted data from YouTube video comments via the fetch_video_comments method in lib/youtube_client.py. The instructions guide the agent to extract themes and action items from these comments. Because there are no boundary markers or specific 'ignore' instructions for the external content, malicious prompts contained within comments could potentially influence the agent's behavior during analysis or subsequent tasks.
[EXTERNAL_DOWNLOADS]: The skill performs legitimate network operations to fetch data and publish content. It communicates with established service domains including googleapis.com (YouTube Data API), api.publora.com (Publishing), and api.pixfaro.com (Illustration/Thumbnail generation). These interactions are consistent with the skill's primary purpose.

youtube-marketing