The Agent Skills Directory

[COMMAND_EXECUTION]: The skill uses subprocess.run in src/xyz_skill/audio_splitter.py to execute ffmpeg and ffprobe for audio processing and duration detection. While these use argument lists rather than shell strings, they represent a significant command execution surface.
[COMMAND_EXECUTION]: In src/xyz_skill/transcription.py, the CustomCommandTranscriber class enables the execution of arbitrary shell commands defined in a config.yaml file. Although it utilizes shlex.split to prevent simple argument injection, it allows the agent to run any local binary specified in the user-provided configuration.
[PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection (Category 8) because it fetches and processes untrusted audio content which is converted to text and then summarized by the AI.
Ingestion points: Podcast content is fetched from external Xiaoyuzhou URLs, transcribed, and saved to transcripts/full_transcript.txt before being read by the agent in src/xyz_skill/summarizer.py.
Boundary markers: The summary instruction in summarizer.py provides the file path to the agent but lacks explicit delimiters or instructions to ignore embedded commands within the transcript content itself.
Capability inventory: The skill has the capability to write to the local file system, download external files via requests, and execute shell commands via subprocess.run.
Sanitization: There is no evidence of content sanitization, filtering, or instruction-stripping performed on the transcript text before it is presented to the AI for summarization.

xiaoyuzhou-transcript-summarizer