The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/download_subtitles.py executes the external utility yt-dlp using subprocess.run. The implementation correctly passes arguments as a list rather than a single string, which is a security best practice that prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill configuration and setup script (setup.sh) install standard, reputable packages from the official Python Package Index (PyPI), such as google-api-python-client and yt-dlp. These are well-known libraries for the stated purpose of the skill.
[DATA_EXFILTRATION]: No unauthorized data exfiltration or credential harvesting was detected. The skill uses standard patterns for API key management, encouraging the use of environment variables or clearly marked configuration placeholders.
[INDIRECT_PROMPT_INJECTION]: This category is noted because the skill fetches untrusted data from the YouTube API, including video titles, descriptions, and user comments.
Ingestion points: External data enters the agent context via API calls in scripts/youtube_api.py (e.g., search_videos, get_comments).
Boundary markers: The skill returns data in structured JSON or CSV formats, which provides clear delimiters for the agent.
Capability inventory: The skill can write results to local files using the --output flag and execute yt-dlp via subprocess.
Sanitization: The skill uses standard JSON serialization for output. Users and agents should be aware that content fetched from YouTube (like comments) is user-generated and should be treated as untrusted data.

youtube-data-api