The Agent Skills Directory

[COMMAND_EXECUTION]: The skill makes extensive use of the Bash tool to execute shell commands for checking tool availability, downloading media, and managing files.
[EXTERNAL_DOWNLOADS]: The skill installs external software dependencies at runtime including yt-dlp (via Homebrew, apt, or pip) and openai-whisper (via pip). While these are common tools, they represent a dependency on external code execution environments.
[PRIVILEGE_ESCALATION]: The skill's installation instructions for Linux systems explicitly use sudo apt update && sudo apt install -y yt-dlp, which grants the agent elevated permissions to modify the host system's software packages.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources (YouTube video titles and transcripts) which could contain malicious instructions designed to influence agent behavior.
Ingestion points: Video titles and transcript content are fetched via yt-dlp and whisper commands respectively.
Boundary markers: No specific delimiters or "ignore instructions" warnings are used when processing the fetched content.
Capability inventory: The skill has access to shell execution (Bash), file system operations (Read, Write), and network access via yt-dlp.
Sanitization: The skill applies basic character replacement using tr (e.g., tr '/' '_') on video titles before using them in filenames, but this may not be exhaustive against sophisticated injection or command substitution attempts.
[DYNAMIC_EXECUTION]: The skill generates and executes inline Python scripts using python3 -c to perform transcript post-processing and deduplication, involving variable interpolation into the script string.

youtube-transcript