The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run within scripts/youtube_to_post.py to perform automated Git operations (git add, git commit, git push). These calls are implemented using argument lists rather than shell strings, which follows security best practices to prevent command injection. These operations are only triggered if the user enables the --deploy flag or configures auto_deploy: true in their local settings.
[EXTERNAL_DOWNLOADS]: The script fetches video metadata and thumbnail information from YouTube using the standard yt-dlp library and requests. These external calls are necessary to retrieve the content required to generate the blog posts. The URLs targeted are limited to well-known YouTube domains.
[INDIRECT_PROMPT_INJECTION]: The skill represents a surface for indirect prompt injection as it ingests and processes untrusted data from YouTube video descriptions.
Ingestion points: Video descriptions and titles are fetched in scripts/youtube_to_post.py using get_video_info.
Boundary markers: The skill does not currently use explicit delimiters or "ignore instructions" warnings for the interpolated data.
Capability inventory: The script has the capability to write files to the user's blog directory and execute Git commands via subprocess.run.
Sanitization: The skill includes sanitize_text_for_yaml to remove problematic characters and humanize_article to filter common AI writing patterns, which serves as a basic layer of content cleaning.

youtube-to-blog-post