The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/analyze.py uses subprocess.run to execute yt-dlp for downloading videos from various platforms. The command is constructed as a list of arguments without using a shell, which effectively prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill downloads video content from user-provided URLs using httpx for direct links and yt-dlp for video sharing platforms. This behavior is documented and essential for the skill's primary function of analyzing internet-hosted videos.
[DATA_EXFILTRATION]: The skill extracts frames from videos and sends them, along with user prompts, to external AI service providers (such as OpenAI or Volcengine) via their respective APIs. This is the core intended functionality of the skill and is controlled by user-provided configuration and API keys.
[CREDENTIALS_UNSAFE]: The skill manages API keys through environment variables (e.g., ARK_API_KEY, OPENAI_API_KEY) and local configuration files (agent_config.toml). It follows standard practices for secret management in developer-oriented CLI tools, including a search strategy for configuration files in the current directory, git root, and home directory.

video-analyzer