The Agent Skills Directory

[DATA_EXPOSURE_AND_EXFILTRATION]: The skill's instructions in SKILL.md mandate environment fingerprinting via shell commands (uname -a, echo $SHELL, $PSVersionTable.PSVersion). These commands expose kernel version, architecture, shell environment, and PowerShell version to the agent, facilitating system discovery.
[DYNAMIC_EXECUTION]: The script scripts/anibon/markdown.py utilizes __import__("sys") for dynamic module access. This pattern is often used to bypass static analysis tools or to obfuscate dependencies.
[DYNAMIC_EXECUTION]: Multiple scripts, including scripts/anibon/chunk_io.py and scripts/clean_garbled_english.py, use the xml.etree.ElementTree library for parsing chunk files. This library is vulnerable to XML External Entity (XXE) attacks in its default configuration, which could allow local file disclosure if the agent is tricked into processing a malicious XML file.
[INDIRECT_PROMPT_INJECTION]: The skill processes untrusted auto-generated transcripts downloaded from YouTube, which serves as a significant attack surface.
Ingestion points: Raw transcripts are fetched via yt-dlp in scripts/anibon/ytdlp.py.
Boundary markers: The skill lacks instructions for the agent to use boundary markers or to ignore instructions embedded within the transcript data.
Capability inventory: The skill has the ability to write files and execute shell commands via subprocess.run (calling yt-dlp and ffmpeg).
Sanitization: The processing logic uses regex mappings for text correction but does not sanitize the input against prompt injection payloads.
[REMOTE_CODE_EXECUTION]: Scripts such as scripts/anibon/ytdlp.py and scripts/_vision.py use subprocess.run to execute external binaries (yt-dlp, ffmpeg) using parameters derived from external video URLs. While not using a shell, this creates a dependency on the security of the external binaries when processing untrusted input.

cleaning-auto-transcripts