The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes data from the YouTube Data and Analytics APIs, which can include user-contributed metadata such as video titles and descriptions. This creates an attack surface where malicious instructions embedded in YouTube content could influence the agent's behavior.
Ingestion points: Data returned from youtube.videos.insert and youtubeAnalytics.reports.query in SKILL.md.
Boundary markers: None present; the skill does not instruct the agent to distinguish between its own logic and external content.
Capability inventory: The skill has capabilities to read local files (fs.createReadStream) and perform write operations via the YouTube API (insert videos/playlists, set thumbnails) as shown in the code blocks in SKILL.md.
Sanitization: No sanitization or validation logic is provided for external data within the skill's instructions.
[EXTERNAL_DOWNLOADS]: The skill references the googleapis library for Node.js in its code examples. This is an official package from a well-known service provider and is used for its intended purpose of interacting with Google's APIs.

youtube-marketing