Yt Dlp

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:18 PM UTC
• Version: 1.0.1

Overview

This is a disclosed yt-dlp media-download wrapper; its cookie-auth and install examples require care, but there is no hidden, automatic, persistent, or destructive behavior in the artifact.

Install only from trusted yt-dlp and ffmpeg sources, prefer pinned or package-managed installs when possible, and avoid sudo curl installation unless you verify the artifact. Use browser-cookie options only on your own trusted machine and prefer a manually exported, site-scoped cookies.txt file for agent workflows.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/guide.md:51

Finding

Unpinned and Unverified Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: references/guide.md:51, references/guide.md:59-60; duplicated in references/usage.md:50, references/usage.md:58-59; unpinned pip installation also appears in SKILL.md:60
Vulnerability Type: Supply-chain exposure through mutable, unverified dependency installation
Risk Level: Medium

Vulnerable Code

bash

pip install -U yt-dlp

bash

sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

The related instruction in SKILL.md:60 is:

text

Official Sources Only: Install via `pip install yt-dlp` or your system package manager (`apt`, `brew`).

Technical Analysis

The installation instructions do not pin a reviewed version of yt-dlp or verify the integrity or authenticity of the downloaded artifact.

The pip commands resolve the package version dynamically. The standalone installation follows the mutable GitHub latest release URL and writes the resulting artifact into the privileged, system-wide /usr/local/bin directory. No checksum, cryptographic signature, trusted version identifier, or reproducible lock file is used.

Although the documented sources are the official package and project repositories, a compromise of the package registry, upstream maintainer account, release artifact, repository, or download redirect chain could substitute attacker-controlled executable code. The absence of integrity validation means that the documented installation procedure would not detect that substitution.

This is a supply-chain weakness rather than evidence that the current yt-dlp project or the audited Skill contains malicious code.

Attack Path

1. An attacker compromises or substitutes an upstream package, release artifact, maintainer account, or relevant distribution channel.
2. A user follows the documented pip install -U yt-dlp, pip install yt-dlp, or mutable releases/latest in ...[truncated 1309 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to a specifically reviewed release rather than resolving the newest release dynamically.
2. Publish and verify an expected SHA-256 or stronger cryptographic digest before installing a standalone executable.
3. Where supported by the upstream project, verify a cryptographic release signature using a separately authenticated signing key.
4. Replace the mutable releases/latest URL with an immutable, version-specific release URL.
5. Download the artifact to a non-privileged staging directory, validate it, and only then install it into a system executable directory.
6. Prefer a dedicated virtual environment rather than a system-wide Python installation.
7. Use a reproducible dependency lock file with hashes, such as a requirements file consumed with pip --require-hashes.
8. Document a controlled update process that reviews release notes, updates the pinned version and digest, and tests the new release before deployment.
9. Keep package-manager alternatives limited to trusted, configured repositories and document their trust assumptions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (15)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

The documented use of --cookies-from-browser chrome can grant the tool direct access to active browser session cookies, which are sensitive authentication material. Even though the stated purpose is legitimate media access, exposing this capability inside an autonomous agent skill materially increases the risk of credential misuse, account/session hijacking, or collection of unrelated browsing-session data if the skill is triggered improperly or combined with other unsafe behavior.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

*
    ```bash
    scripts/download.sh "URL" -x --audio-format mp3
    ```

4.  **Download specific resolution (e.g., 1080p):**
    ```bash
    scripts/download.sh "URL" -f "bv*[height<=1080]+ba/b[height<=1080]"
    ```

5.  **Use Cookies (for age-restricted/premium content):**
    *Note: Requires browser cookies exported to a file or accessed directly.*
    ```bash
    scripts/download.sh "URL" --cookies-from-browser chrome
    ```

## Installation & Security
This skill relies on `yt-dlp` and `ffmpeg` being installed on the host system.
- **Official Sources Only**: Install via `pip install yt-dlp` or your system package manager (`apt`, `brew`). Avoid running curl scripts from untrusted sources.
- **Cookies**: Use `--cookies-from-browser` with caution. For autonomous agents, prefer exporting a `cookies.txt` file manually to limit access to your active browser session.

## Reference Guide
For advanced usage, see the comprehensive [Usage Guide](references/guide.md).

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/guide.md (reported line 204)May include surrounding context.

To write metadata to the video file and save the thumbnail to disk:

bash

yt-dlp --add-metadata --write-thumbnail "URL"

To embed the thumbnail into the file (for music players, etc.):

bash

yt-dlp --embed-thumbnail "URL"

7.3 Authentication (Cookies)

Some videos (age-restricted or premium) require login. The safest way is to import cookies from your browser.

bash

yt-dlp --cookies-from-browser chrome "URL"

Replace chrome with firefox, brave, edge, or safari as needed.

7.4 Output Templates

Customize the filename of downloaded files.

bash

yt-dlp -o "%(uploader)s - %(title)s [%(id)s].%(ext)s" "URL"

Common placeholders:

• %(title)s: Video title
• %(uploader)s: Channel name
• %(upload_date)s: Date (YYYYMMDD)
• %(id)s: Video ID

---

8. Configuration File

Instead of typing arguments every time, save them in a configuration file. Location:

• Linux/macOS: ~/.config/yt-dlp/config
• Windows: `%APPDATA%\yt-dlp

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 86% confidence

Finding

The YARA hit is triggered by browser cookie extraction behavior, which overlaps with patterns seen in credential-harvesting tools. In this documentation, the feature is presented for legitimate authentication, but it still involves accessing live browser session data; without strong warnings, users may expose sensitive session tokens or normalize behavior that resembles data theft in less trusted environments.

Content

Scanner excerpt · references/usage.md (reported line 192)May include surrounding context.

a

To write metadata to the video file and save the thumbnail to disk:

bash

yt-dlp --add-metadata --write-thumbnail "URL"

To embed the thumbnail into the file (for music players, etc.):

bash

yt-dlp --embed-thumbnail "URL"

7.3 Authentication (Cookies)

Some videos (age-restricted or premium) require login. The safest way is to import cookies from your browser.

bash

yt-dlp --cookies-from-browser chrome "URL"

Replace chrome with firefox, brave, edge, or safari as needed.

7.4 Output Templates

Customize the filename of downloaded files.

bash

yt-dlp -o "%(uploader)s - %(title)s [%(id)s].%(ext)s" "URL"

Common placeholders:

• %(title)s: Video title
• %(uploader)s: Channel name
• %(upload_date)s: Date (YYYYMMDD)
• %(id)s: Video ID

---

8. Configuration File

Instead of typing arguments every time, save them in a configuration file.

Location:

• Linux/macOS: ~/.config/yt-dlp/config
• Windows: `%APPDATA%\yt-dlp\c

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are very broad and map closely to ordinary user requests such as downloading a video or extracting MP3 audio. In an agent environment, that increases the chance of unintended or automatic activation, which can cause the agent to perform network downloads and file writes without sufficiently explicit user intent or safety checks.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The documentation instructs users to run curl under sudo and write directly into /usr/local/bin, combining network retrieval with elevated privileges. If the downloaded content is tampered with, intercepted, or the URL is replaced, this pattern can lead to privileged installation of untrusted code.

Content

Scanner excerpt · references/guide.md (reported line 60)May include surrounding context.

Linux:

bash

sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/guide.md (reported line 187)May include surrounding context.

7.2 Thumbnails and Metadata

To write metadata to the video file and save the thumbnail to disk:

bash

yt-dlp --add-metadata --write-thumbnail "URL"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guide recommends --cookies-from-browser as the 'safest way' to authenticate but does not warn that this accesses browser-stored session cookies, which may grant account access and may be sensitive on shared or managed systems. In a CLI wrapper skill, normalizing browser cookie extraction without consent and scope warnings increases the chance of accidental exposure or misuse of active login sessions.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/guide.md (reported line 61)May include surrounding context.

Linux:

bash

sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/usage.md (reported line 58)May include surrounding context.

Linux:

bash

sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/usage.md (reported line 59)May include surrounding context.

Linux:

bash

sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · references/usage.md (reported line 177)May include surrounding context.

7.2 Thumbnails and Metadata

To write metadata to the video file and save the thumbnail to disk:

bash

yt-dlp --add-metadata --write-thumbnail "URL"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documentation recommends importing browser cookies for authenticated downloads but does not clearly warn that those cookies grant access equivalent to the logged-in session and may expose private, age-restricted, or premium content if mishandled. In a CLI wrapper context, normalizing cookie extraction without caution can lead users to over-share session-bearing data or use the feature in unsafe environments.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/guide.md (reported line 260)May include surrounding context.

md

**"ffmpeg not found"**
- Install FFmpeg.
- On Ubuntu/Debian: `sudo apt install ffmpeg`
- On macOS: `brew install ffmpeg`

**"Sign in to confirm you’re not a bot"**

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · references/usage.md (reported line 243)May include surrounding context.

md

**"ffmpeg not found"**
- Install FFmpeg.
- On Ubuntu/Debian: `sudo apt install ffmpeg`
- On macOS: `brew install ffmpeg`

**"Sign in to confirm you’re not a bot"**

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The documentation instructs users to download English subtitles using --sub-langs "en.*", which can be read as prescribing a specific language. Because no language choice or opt-in is mentioned, this may conflict with a policy against forcing a locale without user selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.