The Agent Skills Directory

[INDIRECT_PROMPT_INJECTION]: The skill processes external video files provided via URLs in the 'file_urls' field, which represents a data ingestion surface. * Ingestion points: The 'file_urls' parameter in SKILL.md allows processing of untrusted remote content. * Boundary markers: The provided prompt templates do not include specific delimiters or instructions to ignore embedded content. * Capability inventory: The skill's functionality is limited to communicating with the EachLabs API via curl. * Sanitization: There is no mention of sanitization for the audio/video content before transcription.- [DATA_EXFILTRATION]: The skill documentation includes curl commands that connect to 'eachsense-agent.core.eachlabs.run'. This domain is the official API endpoint for the skill author and is considered a safe vendor resource.- [CREDENTIALS_UNSAFE]: The skill instructions demonstrate using the '$EACHLABS_API_KEY' environment variable for authentication, adhering to the best practice of avoiding hardcoded credentials.

subtitle-generation