The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses subprocess.run to interact with system utilities like ffmpeg, ffprobe, and the macOS security command. It employs list-based arguments, which is the recommended practice for preventing command injection vulnerabilities.
[CREDENTIALS_UNSAFE]: The skill manages the ElevenLabs API key by retrieving it from environment variables or the macOS Keychain. This avoids hardcoding secrets and utilizes platform-native secure storage, following industry best practices for credential management. It also includes redaction logic to prevent the key from appearing in error messages.
[INDIRECT_PROMPT_INJECTION]: The workflow involves processing user-supplied reference texts and transcripts. To mitigate the risk of malicious instructions embedded in these inputs, the skill performs strict validation using similarity metrics and character change budgets (requiring >= 0.88 similarity), ensuring the output reflects the actual audio content and hasn't been significantly altered.
[DATA_EXPOSURE]: The skill implements strong safeguards for its temporary workspace, including path validation to ensure operations remain within temporary directories, ownership verification, and unique ownership tokens to prevent unauthorized file access or deletion during the subtitle generation process.

yh-tools-video2srt