The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run to execute the external utility yt-dlp for metadata and subtitle retrieval.
Execution is performed using an argument list rather than a shell string, which prevents shell injection.
The input URL is validated and reconstructed to ensure it only points to a legitimate YouTube video before being passed to the subprocess.
[SAFE]: File system paths are safely generated using a slugification process that limits directory and filenames to alphanumeric characters, preventing path traversal.
[SAFE]: External content from YouTube (transcripts and metadata) is escaped and structured in YAML/Markdown before being written to the vault, reducing the risk of indirect prompt injection for downstream tools.

ingest-youtube