The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill makes network requests to https://deepapi.co (or a user-defined base URL) to retrieve transcript data. It also relies on the yt-dlp tool, which connects to YouTube services and supports self-updating (yt-dlp -U).
[COMMAND_EXECUTION]: The skill uses several shell-based tools to perform its tasks, including curl for API interaction, jq for JSON parsing, uuidgen for request headers, and yt-dlp for local transcript extraction.
[INDIRECT_PROMPT_INJECTION]: The skill processes external, untrusted content from YouTube transcripts. This introduces a surface for indirect prompt injection if the agent reads and follows instructions potentially embedded in video subtitles.
Ingestion points: Transcript data received from the DeepAPI endpoint and .json3 subtitle files generated by yt-dlp in SKILL.md.
Boundary markers: None identified; the content is saved directly to files and processed as raw text.
Capability inventory: File system write access, network requests via curl, and shell command execution.
Sanitization: Filenames are sanitized using tr to remove unsafe characters. The transcript text itself is processed by an inline Python script that performs HTML unescaping and whitespace normalization, but it does not scan for malicious instruction patterns.
[DYNAMIC_EXECUTION]: The skill contains a small, static Python script executed via a heredoc to flatten complex JSON subtitle structures into plain text. This script runs locally and uses standard library modules for data processing.

youtube-transcript