andrebrov/broll-sourcing
Drop in one talking-head video and get it finished — transcribe it, search the web for supporting b-roll (article screenshots, memes, images, video clips), present the asset list for approval, then hand off to reel-builder to normalize audio, burn subtitles, cut the b-roll in, and export for Instagram and LinkedIn. Use when the user drops a video and wants illustrations/screenshots/memes added, asks to "edit this like CapCut", wants b-roll found for them, or wants a talking-head take prepped for Instagram/LinkedIn. Sourcing and approval only — all rendering belongs to the reel-builder skill.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow searches the web and fetches external articles, memes, images, and video clips using WebSearch and curl/yt-dlp based on the transcript's claims, ingesting outsider-authored free text into the agent's context.
Where we found it
web search results (arbitrary domains via WebSearch)
content-type · 3 sites
The SKILL.md instructs the agent to use WebSearch to find articles, memes, images, and video clips based on the transcript's claims, then fetch them via Chrome navigate/screenshot, curl, and yt-dlp — ingesting arbitrary outsider-authored web content into the agent's context.
SKILL.md
146
| Article / headline | `WebSearch` | Chrome `navigate` + dismiss the cookie wall, then `python3 $SKILLS/capture_window.py shot --window Chrome --out raw/broll/NN_slug.png` |
SKILL.md
147
| Meme / image | `WebSearch` | `curl -L -o raw/broll/NN_slug.jpg "URL"` |
SKILL.md
148
| Video clip | `WebSearch` | `yt-dlp --download-sections "*1:10-1:25" -o raw/broll/NN_slug.mp4 "URL"` |
descriptapi.com
domain · 1 site
The SKILL.md documents the Descript API (https://descriptapi.com/v1) as an optional external service the agent can call when a token is available, for Studio Sound and Eye Contact processing — a specific external domain the plugin fetches from at runtime.
SKILL.md
445
Base `https://descriptapi.com/v1`, `Authorization: Bearer <token>`. Read the
- Audited
- Security analysis