The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads the youtube-transcript-plus package from the official npm registry during the installation phase.
[PROMPT_INJECTION]: The skill processes untrusted transcript data from YouTube, which presents a surface for indirect prompt injection.
Ingestion points: transcript.js fetches transcript text from the YouTube API using the youtube-transcript-plus library.
Boundary markers: No delimiters or protective instructions are used to isolate the fetched content in the output.
Capability inventory: Analysis of transcript.js shows no dangerous operations such as shell command execution, file system writes, or exfiltration of sensitive local data.
Sanitization: Transcript content is printed directly as retrieved without sanitization or filtering.

youtube-transcript