The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill downloads binaries and installer scripts from well-known and trusted services to fulfill its primary purpose of setting up a media environment.
Fetches the yt-dlp binary directly from its official GitHub releases page (https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp) in scripts/install.sh.
References the official installation script for the uv Python tool from Astral (https://astral.sh/uv/install.sh) in SKILL.md and scripts/install.sh.
[REMOTE_CODE_EXECUTION]: The scripts/install.sh script utilizes a piped-to-shell pattern to install uv (curl -fsSL https://astral.sh/uv/install.sh | sh). While this is a sensitive pattern, it targets a well-known service (Astral) and is consistent with the skill's documented intent to bootstrap the environment.
[COMMAND_EXECUTION]: The skill invokes system package managers (apt-get on Linux and brew on macOS) to install dependencies. On Linux, it may use sudo for elevated privileges to perform these installations, which is expected behavior for a system-level setup utility.
[INDIRECT_PROMPT_INJECTION]: The skill processes user-supplied arguments via a JSON parser helper (json_get) in scripts/_mediaskills_common.sh.
Ingestion points: Arguments passed via --args or --tool flags to the bash scripts.
Boundary markers: None; values are passed directly to Python's json.loads or shell variables.
Capability inventory: The skill can execute shell commands, install system packages, and perform network downloads.
Sanitization: Arguments are parsed as JSON and used in command -v lookups or informative output. The risk of command injection is low as the values are primarily used for existence checks (which).

install-media-tools