Youtube Downloader Skimmer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:58 AM UTC
• Version: 1.0.0

Overview

This looks like a media downloader, but its default external delivery and raw-file deletion behavior are not clearly opt-in or well scoped.

Review before installing. Treat basic runs as potentially sending generated media to QQ/Telegram and deleting the raw downloaded file unless the skill is corrected. Prefer disabling external delivery, changing raw deletion to explicit opt-in, pinning dependencies, and sanitizing output filenames before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: package.json:27

Finding

Unpinned and Ecosystem-Mismatched Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

--hash=sha256: ``` 5. Update both `README.md` and `SKILL.md` to direct users to the locked installation process rather than an unconstrained `pip install yt-dlp` command. 6. Install the FFmpeg executable from a trusted operating-system package repository or a verified official binary distribution. Document the supported package source and version. 7. Run dependency installation as an unprivileged account, disable unnecessary npm lifecycle scripts where appropriate, and use automated dependency integrity and vulnerability scanning in CI. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose says the skill downloads YouTube videos and clips key segments, but the documentation also describes MP3 extraction, sending outputs to QQ/Telegram, and deleting raw files by default. This mismatch is dangerous because users and policy systems may approve the skill for local media processing while overlooking exfiltration and destructive file-handling behaviors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes deletion of original files without warning users about irreversible data loss if the option is enabled. In the context of a media-processing skill that downloads and clips files automatically, destructive behavior is more dangerous because users may assume outputs are additive and may not keep backups.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises automatic sending to QQ/Telegram but does not disclose that media files may be transmitted to third-party platforms, potentially exposing personal or copyrighted content and related metadata. In a downloader/clipping skill, this omission is security-relevant because users may not realize data leaves the local system, increasing privacy and exfiltration risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises behavior that implies shell-capable operations such as invoking yt-dlp and ffmpeg, but it does not declare any tool scope or permissions. That weakens reviewability and enforcement, because a runtime may grant broader execution than users expect for a skill that downloads, processes, and potentially forwards files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill documents a --send-to option for QQ or Telegram but does not prominently warn that downloaded or clipped media may be transmitted to external messaging platforms. That can lead to unintended disclosure of copyrighted, sensitive, or private media to third-party services, especially if users assume processing is local-only.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The parameter table shows --delete-raw defaults to true, but the skill does not clearly warn users that original downloaded videos may be deleted automatically. This creates a risk of accidental data loss, especially when users expect the source file to remain available for verification, reuse, or legal recordkeeping.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The module description presents the skill in both English and Chinese, and the rest of the user-facing strings are primarily Chinese. This imposes a specific language/locale on users without opt-in or justification, which matches the language policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · youtube_downloader.py (reported line 35)May include surrounding context.

python

missing.append("yt-dlp")
    
    # 检查 ffmpeg
    result = subprocess.run(["which", "ffmpeg"], capture_output=True)
    if result.returncode != 0:
        missing.append("ffmpeg")

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · youtube_downloader.py (reported line 42)May include surrounding context.

python

if missing:
        print(f"❌ 缺少依赖：{', '.join(missing)}")
        print("请运行：pip install yt-dlp")
        print("并安装 ffmpeg：sudo apt install ffmpeg (或 brew install ffmpeg)")
        sys.exit(1)
    
    return True

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest and module description promise automatic clipping of key highlights ('关键片段'), which implies some form of salient-segment detection. Instead, get_chapters generates generic segments purely from total duration thresholds and evenly divides longer videos, without analyzing content or actual chapter metadata.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 82% confidence

Finding

The code executes ffmpeg on a downloaded media file and writes output paths derived from untrusted video metadata (title) and chapter names. Although shell=False avoids classic command injection, this still invokes a complex external parser on attacker-controlled content and constructs file paths from unsanitized input, creating risk of path traversal, arbitrary file overwrite within writable locations, or exploitation of ffmpeg parser vulnerabilities via malicious media.

Content

Scanner excerpt · youtube_downloader.py (reported line 135)May include surrounding context.

python

]
        
        try:
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
            if result.returncode == 0:
                clips.append((name, output_file))
                print(f"✅ 剪辑完成：{name}")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The argparse description, argument help text, and many printed status/error messages are written in Chinese, with no mechanism for users to choose another language. For a general-purpose downloader, this is an unjustified locale restriction under the natural-language policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Most of the operational documentation and headings are presented in Chinese, with no indication that users may choose another language or that the skill is intentionally region-specific. This can violate language/locale policy when a specific language is imposed without opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

Most user-facing documentation, including the description, usage guidance, parameters, and notes, is presented only in Chinese, while no language choice or locale scope is stated. This can violate a language/locale policy when the skill does not offer opt-in or document a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script presents its title, usage, and examples in Chinese, which imposes a specific language on users without any opt-in or alternative. This is a natural-language locale policy issue because the file contains user-facing text but does not indicate that the skill is intentionally limited to Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The package description is written only in Chinese, which imposes a specific language choice in user-facing metadata without offering any language or locale alternative. This can violate language/locale policy expectations when a skill is intended for a broader audience and does not document that it is region-specific.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The docstring and inline comment describe '获取或生成章节信息' and '如果视频有章节，尝试获取', which indicate the function will first retrieve real chapter information when available. In practice, the function initializes an empty list and immediately falls back to duration-based synthetic segments, with no code path that reads chapter metadata from the downloaded video.

Content

No source excerpt is available for this finding.