The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill requires the installation of standard Python dependencies (requests, python-dotenv) as defined in scripts/requirements.txt. Additionally, the script scripts/youtube_transcript.py fetches data from the RapidAPI YouTube Transcript API at youtube-transcript3.p.rapidapi.com.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted textual data in the form of YouTube transcripts. This creates a surface for indirect prompt injection where malicious instructions embedded in a video's captions could influence the agent's behavior during subsequent processing steps.
Ingestion points: Data is fetched from an external API in scripts/youtube_transcript.py and potentially saved to local text or JSON files.
Boundary markers: The skill does not implement specific delimiters or warnings to the agent to treat the transcript content as untrusted data.
Capability inventory: The skill allows for network requests (GET) and local file writing, though it lacks high-risk capabilities like arbitrary code execution or privilege escalation.
Sanitization: The script scripts/get_plain_text.py performs minimal sanitization by replacing specific HTML entities (e.g., '), but it does not filter the content for instructional patterns.
[COMMAND_EXECUTION]: The script scripts/youtube_transcript.py allows the user or agent to specify an output file path via the -o or --output flag. While intended for saving transcripts, this could be misused to attempt to overwrite files within the agent's workspace if not properly restricted by the platform's environment.

youtube-rapidapi-transcript