The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/download_video.py executes external binaries (yt-dlp, ffmpeg) using subprocess.run. The implementation uses list-based arguments, which is a recommended security practice to prevent shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill is designed to download content from arbitrary external URLs provided by the user. It also makes requests to https://inv.thepixora.com (a public Invidious instance) as a fallback mechanism for YouTube downloads.
[PROMPT_INJECTION]: The skill processes untrusted data from external links and local files, which represents an ingestion surface for indirect prompt injection.
Ingestion points: Processes URLs from direct user input, text files (--url-file), and markdown media inventories (04-media-inventory.md).
Boundary markers: Absent; the skill extracts URLs directly from text without using delimiters or specialized instructions to ignore embedded content.
Capability inventory: Performs network GET requests via requests, executes shell commands via subprocess.run, and writes files to the local file system (Video/Downloads).
Sanitization: Implements _clean_input_url to validate the URL scheme (restricted to http and https), check for control characters or whitespace, and reject URLs containing embedded credentials.

z-video-downloader