Youtube Hq Downloader

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:10 AM UTC
• Version: 1.0.1

Overview

This downloader has a coherent purpose, but its scripts can turn user-supplied URLs or filenames into local shell command execution and can auto-install an unpinned dependency.

Review before installing. Only run this skill with URLs, filenames, and output paths you fully control, and avoid untrusted or generated argument values. Prefer fixing the scripts first by removing shell=True and os.system, validating output names and directories, avoiding wildcard ffmpeg examples, and replacing automatic unpinned pip install with explicit, pinned dependency setup.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: download.py:17

Finding

OS Command Injection Through User-Controlled Downloader Arguments

Content

View full analysis

2 else "merged" output_dir = os.path.expanduser( sys.argv[3] if len(sys.argv) > 3 else "~/Movies" ) ``` Those values are interpolated into shell command strings: ```python cmd1 = f'{yt_dlp} -f "bestvideo" "{url}" -o "{video_file}"' if not run_command(cmd1): sys.exit(1) cmd2 = f'{yt_dlp} -x --audio-format m4a "{url}" -o "{audio_file}"' if not run_command(cmd2): sys.exit(1) cmd3 = ( f'ffmpeg -i "{video_file}" -i "{audio_file}" ' f'-c:v libx264 -c:a aac -shortest "{output_file}" -y' ) if not run_command(cmd3): sys.exit(1) ``` A second shell-execution sink is also used: ```python os.system(f'ls -lh "{output_file}"') ``` ### Technical Analysis The program builds command strings by directly interpolating the URL, output name, and output directory supplied through command-line arguments. It then invokes those strings with `shell=True` or `os.system()`. Double-quoting the interpolated values does not provide sufficient protection. An attacker can include a double quote in an argument to terminate the quoted value and append shell metacharacters such as `;`, `&&`, command substitutions, or redirections. The shell will then interpret the injected content as commands. The imported `shlex` module is not used to quote or tokenize the arguments. Even shell quoting would be less robust than avoiding shell interpretation entirely. # ...[truncated 1480 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: download.sh:47

Finding

Unsafe Filename Expansion and Option Handling in Shell Script

Content

View full analysis

/dev/null | head -1) ``` The resulting user-derived filenames are later processed without an option terminator: ```bash rm -f "${OUTPUT_NAME}_video.mp4" "${OUTPUT_NAME}_audio.m4a" ``` ```bash ls -lh "${OUTPUT_NAME}_combined.mp4" ``` ### Technical Analysis `OUTPUT_NAME` originates from the second command-line argument: ```bash OUTPUT_NAME="${2:-merged}" ``` At line 47, `${OUTPUT_NAME}_video.*` is unquoted. Bash therefore applies word splitting and pathname expansion to the value. Output from `ls` is then parsed as though it were a reliable filename protocol, even though filenames may contain whitespace or newline characters. The script selects the first textual line returned by `ls`, rather than securely tracking the file generated by `yt-dlp`. If an attacker can control the output name or create files in the output directory, crafted names and wildcard characters can cause an unintended file to be selected as the input to `ffmpeg`. The `rm` and final `ls` commands quote their arguments but do not use `--` to terminate option processing. A filename beginning with a hyphen can consequently be interpreted as an option rather than a path. Quoting prevents word splitting but does not disable command option parsing. ### Attack Path 1. An attacker controls the `OUTPUT_NAME` argument or can place specially named files in the chosen output directory. 2. The attacker uses wildcard, whitespace, newline, or leading-hyphen characters in the name. 3. The unquoted expansion at line 47 matches multiple files or produces multiple command arguments. 4. `ls | head -1` selects an unintended file or truncates a filename containing a newline. 5. The selected file is passed to `ffmpeg`, ...[truncated 951 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: download.sh:27

Finding

Automatic Installation of an Unpinned Runtime Dependency

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

This is a true tool-parameter abuse issue because untrusted input is propagated into shell-interpreted command strings for yt-dlp and ffmpeg. In the context of a downloader skill that expects arbitrary user-supplied URLs and filenames, this greatly increases danger because the primary interface is attacker-controlled input.

Content

Scanner excerpt · download.py (reported line 20)May include surrounding context.

python

def run_command(cmd, cwd=None, capture=True):
    """执行shell命令"""
    print(f"🔧 执行: {cmd}")
    result = subprocess.run(cmd, shell=True, cwd=cwd, capture_output=capture, text=True)
    if result.returncode != 0:
        print(f"❌ 命令执行失败: {cmd}")
        if result.stderr:

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The final os.system call executes a shell command containing a path derived from user-controlled output_name/output_dir. Even though the path is wrapped in double quotes, shell expansions such as command substitution may still occur, allowing an attacker to execute arbitrary commands on the host.

Content

Scanner excerpt · download.py (reported line 112)May include surrounding context.

python

print(f"\n✅ 完成!")
    print(f"📁 输出文件: {output_file}")
    os.system(f'ls -lh "{output_file}"')

if __name__ == "__main__":
    main()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill instructs users to run shell commands and execute local scripts, but it does not declare any explicit tool scope such as permissions or allowed-tools. This creates an authorization and review gap: an agent or user may invoke shell-capable behavior without clear restriction boundaries, increasing the chance of unintended command execution or misuse of the skill in broader automation contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The documented ffmpeg command uses the -y flag, which forces overwrite of output files without prompting. In a directory containing an existing output.mp4 or when users adapt the command to other filenames, this can silently destroy data; the wildcard-based examples nearby also make file selection less predictable in manual workflows.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The file’s title, usage instructions, and several runtime messages are written in Chinese, with no indication that users can choose another language or locale. This creates a natural-language locale constraint without opt-in, which matches the policy’s language/locale violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The helper executes arbitrary shell strings with shell=True, and those strings are built from user-controlled inputs such as the YouTube URL and output name. Quoting with double quotes is not sufficient because shell metacharacters like command substitution can still be interpreted, enabling command injection and arbitrary local command execution.

Content

Scanner excerpt · download.py (reported line 20)May include surrounding context.

python

def run_command(cmd, cwd=None, capture=True):
    """执行shell命令"""
    print(f"🔧 执行: {cmd}")
    result = subprocess.run(cmd, shell=True, cwd=cwd, capture_output=capture, text=True)
    if result.returncode != 0:
        print(f"❌ 命令执行失败: {cmd}")
        if result.stderr:

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script exceeds a downloader's expected scope by creating and activating virtual environments and installing software automatically. This is dangerous because it causes side effects on the host system and executes code fetched from external package sources, increasing supply-chain and environment-tampering risk if the package source or network path is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script silently installs yt-dlp with pip when it is missing, without warning or consent. This is risky because it executes a network-based package installation at runtime, which can introduce unreviewed code, surprise system changes, and supply-chain exposure that is broader than the advertised function of downloading media.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

User-visible strings throughout the script are presented in both English and Chinese, but the skill does not state a locale policy or let the user choose a preferred language. This can violate language/locale policy expectations when a skill imposes or mixes languages without opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.