Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

YouTube Downloader

v1.0.3

Downloads YouTube videos to ~/Downloads. Use when user wants to download a YouTube video to their machine.

2· 904·4 current·4 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description, required binary (yt-dlp), brew install, and the included download.sh all align with a simple YouTube download helper. Nothing requested is unrelated to downloading video files.
Instruction Scope
SKILL.md and download.sh only accept a URL and call yt-dlp to write an MP4 into $HOME/Downloads. They do not read other files, environment variables, or contact unexpected endpoints beyond what yt-dlp needs to fetch media.
Install Mechanism
Install spec uses a Homebrew formula for yt-dlp, which is a standard, low-risk source. Minor operational note: the skill declares no OS restriction but relies on brew being available; that is an availability/compatibility issue rather than a security issue.
Credentials
No credentials or sensitive environment variables are requested. The script uses $HOME and a single URL argument only, which is proportional to the stated task.
Persistence & Privilege
The skill does not request persistent/always-on privileges, does not modify other skills or global agent configuration, and runs only when invoked.
Assessment
This skill is straightforward and appears coherent, but before installing consider: (1) yt-dlp will access remote hosts to download media — only use it for content you are allowed to download; (2) Homebrew is the listed install path (ensure brew is available on your system or install yt-dlp by another trusted method); (3) review download.sh yourself (it's short and readable) and run it in a safe environment if you have concerns about running third-party scripts; (4) running the skill will write files into your ~/Downloads directory, so check disk space and expected filenames.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

⬇️ Clawdis
Binsyt-dlp

Install

Install yt-dlp (brew)
Bins: yt-dlp
brew install yt-dlp
latestvk978qfp6bqrjxt0ydxxgc51hcn8271pr
904downloads
2stars
4versions
Updated 6h ago
v1.0.3
MIT-0

Download

Downloads YouTube videos to your ~/Downloads folder using yt-dlp.

What it does

  • Takes a YouTube URL as input
  • Downloads the best available quality (video + audio merged to MP4)
  • Saves to ~/Downloads with the video title as filename

Usage

{baseDir}/download.sh "https://youtube.com/watch?v=VIDEO_ID"

Or just give me the URL and I'll run it for you.

Requirements

  • yt-dlp must be installed: brew install yt-dlp
  • On first run, if yt-dlp is missing, the skill will prompt you to install it

Comments

Loading comments...