The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external tools ffmpeg and yt-dlp to process video data and extract frames. These operations are performed via Python subprocess calls in scripts/contact_sheet.py and scripts/extract_slides.py, and through shell scripts like scripts/download.sh and scripts/detect_slides.sh. Input parameters, specifically YouTube IDs, are strictly validated against a regular expression pattern to mitigate injection risks.
[EXTERNAL_DOWNLOADS]: The skill fetches video media, captions, and metadata from YouTube's official services. It also makes an API request to YouTube's oEmbed endpoint in scripts/setup.sh to verify playback permissions. These network operations are directed at well-known services and are fundamental to the skill's intended use case.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from YouTube transcripts which could theoretically contain malicious instructions. To defend against this, the skill includes a dedicated sanitization function in scripts/vtt_to_transcript.py that escapes Markdown and HTML special characters, ensuring the transcript text remains inert when the agent reads it to generate annotations.

youtube-notetaker