The Agent Skills Directory

[COMMAND_EXECUTION]: The skill frequently invokes external command-line tools such as ffmpeg and yt-dlp using the subprocess module in several modules like corekit/cut_video.py and corekit/render_hardsubs.py. These invocations are implemented using list-based arguments, which is a security best practice to prevent shell injection.
[EXTERNAL_DOWNLOADS]: The corekit/fetch_source.py module utilizes the yt-dlp utility to download video and subtitle assets from YouTube, which is the primary function of the skill.
[DATA_EXFILTRATION]: The skill downloader includes the --cookies-from-browser chrome flag when calling yt-dlp. This grants the tool access to the user's Chrome browser cookies for authenticated YouTube sessions, representing a sensitive data access behavior documented in the skill's instructions.
[PROMPT_INJECTION]: The skill processes untrusted subtitle data from YouTube, presenting a surface for indirect prompt injection. 1. Ingestion points: Subtitle files are parsed by corekit/subtitle_to_json.py into JSON for analysis. 2. Boundary markers: No delimiters or ignore-instruction warnings are used when processing the transcript. 3. Capability inventory: The skill can execute subprocesses and write to the filesystem across multiple scripts. 4. Sanitization: No content validation or sanitization is performed on the subtitles before they are passed to the agent for analysis.

autocliper-ai