Dwnldr

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:12 PM UTC
• Version: 1.0.0

Overview

This downloader skill has a coherent media-download purpose, but it asks the agent to download, strip provenance metadata, send files onward, and use Chrome session cookies without clear user confirmation.

Review before installing. Only use this skill if you are comfortable with automatic downloads, local file writes, metadata removal, and sending files through Telegram or LocalSend. Do not allow browser-cookie access unless you explicitly intend authenticated downloading from a specific profile, and prefer a revision that requires confirmation before downloading, stripping metadata, or forwarding files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:18
• Finding: Automatic URL Trigger Overrides Explicit User Intent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 18-32 **Vulnerability Type**: Automatic execution caused by instruction hijacking **Risk Level**: High ### Vulnerable Code ```markdown ## URL Detection (AUTO-TRIGGER) **CRITICAL:** When the user sends a message that contains a URL from any of these domains, AUTOMATICALLY treat it as a download request. Do NOT ask "what do you want me to do with this?" — just download it. **Auto-detect domains:** - `youtube.com`, `youtu.be`, `m.youtube.com` - `tiktok.com`, `vm.tiktok.com` - `instagram.com` (reels, posts, stories) - `x.com`, `twitter.com` - `reddit.com` (video posts) - `twitch.tv` (clips) - `vimeo.com` - `facebook.com` (videos, reels) **Pattern:** If user message contains a URL matching these domains → skip questions, download immediately. ``` ### Technical Analysis The Skill explicitly instructs the Agent to reinterpret any message containing a listed URL as a download command. It also prohibits clarification, regardless of whether the user asked to download the linked content. URL presence is not sufficient evidence of authorization. A user may provide a URL for summarization, safety analysis, comparison, reporting, or ordinary discussion. The instruction therefore changes the current session goal and causes side effects that are disconnected from the user's expressed intent. The resulting operation can make outbound network requests, retrieve third-party content, consume bandwidth, and write files to local storage. Because the Agent is told to skip confirmation, these effects occur without informed user approval. ### Attack Path 1. An attacker or untrusted message supplies a URL from one of the listed domains. 2. The URL is included in a conversation for a purpose unrelated to downloading, such as analysis or reporting. 3. The Skill treats the mere presence of the URL as authorization. 4. The Agent invokes `yt-dlp` and contacts the external service. 5. Remote content is downloade ...[truncated 870 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove the instruction that URL presence alone automatically authorizes a download. - Require an explicit download request, such as “download this video,” before invoking any tool. - When user intent is ambiguous, ask for confirmation and describe the expected network, storage, and delivery effects. - Parse URLs structurally and compare normalized hostnames against an allowlist; do not use substring matching. - Display the normalized destination hostname and requested operation before downloading. - Require separate confirmation before sending downloaded content through Telegram or LocalSend. - Apply file-size, download-count, runtime, and storage quotas to limit resource abuse. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:38
• Finding: Unsafe Shell Command Construction with Untrusted Values<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 38-94 **Additional Locations**: `SKILL.md`, lines 113-127 **Vulnerability Type**: Shell command injection and unsafe filename handling **Risk Level**: Critical ### Vulnerable Code ```bash yt-dlp --js-runtimes nodejs \ -f "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best" \ --merge-output-format mp4 \ --no-playlist \ --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \ "<URL>" ``` ```bash yt-dlp --js-runtimes nodejs \ -f "best" \ --no-playlist \ --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \ "<URL>" ``` ```bash ffmpeg -i "/home/rami/.openclaw/workspace/_incoming/<filename>" \ -map_metadata -1 \ -fflags +bitexact \ -flags:v +bitexact \ -flags:a +bitexact \ -c copy \ "/home/rami/.openclaw/workspace/_incoming/<filename>_clean.mp4" \ && mv "/home/rami/.openclaw/workspace/_incoming/<filename>_clean.mp4" \ "/home/rami/.openclaw/workspace/_incoming/<filename>" ``` ```bash ls -lh /home/rami/.openclaw/workspace/_incoming/<filename> ``` ```bash openclaw message send \ --channel telegram \ --target <user_id> \ --message "🎬 Downloaded: <title>" \ --media /home/rami/.openclaw/workspace/_incoming/<filename> ``` ```bash localsend-cli send --to "<user_device>" /home/rami/.openclaw/workspace/_incoming/<filename> ``` The same substitution pattern also appears in the audio-only and playlist commands: ```bash yt-dlp --js-runtimes nodejs \ -x --audio-format mp3 \ --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \ "<URL>" ``` ```bash yt-dlp --js-runtimes nodejs \ -f "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best" \ --merge-output-format mp4 \ --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \ "<URL>" ``` ### Technical Analysis The Skill expresses operations as shell command templates containing placeholders such as `<URL>`, ...[truncated 2963 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never create executable shell source through textual placeholder replacement. - Invoke each executable through a structured process API using an argument array, with shell execution disabled. - Parse URLs with a standards-compliant URL parser and accept only explicitly supported schemes and normalized hostnames. - Generate random local filenames, such as UUID-based names, instead of reusing remote media titles as operational paths. - Store the human-readable title separately from the filesystem name. - Maintain a trusted mapping between generated identifiers and canonical file paths. - Resolve and verify every path before use, ensuring it remains inside the intended incoming directory. - Use `--` before positional path arguments for tools that support it. - Reject filenames containing path separators, control characters, null bytes, or traversal sequences. - Quote all path arguments even when using generated filenames; quoting should supplement, not replace, shell-free process invocation. - Validate Telegram identifiers and LocalSend device identifiers against strict allowlists or expected identifier formats. - Run media-processing commands in a restricted sandbox with minimal filesystem access, no unnecessary credentials, and constrained outbound networking. - Apply execution timeouts and file-size limits to `yt-dlp` and `ffmpeg`. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:151
• Finding: Chrome Session Cookies May Be Accessed Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 151-154 **Vulnerability Type**: Unauthorized access to browser authentication material **Risk Level**: High ### Vulnerable Code ```markdown | Error | Fix | |-------|-----| | "Video unavailable" | Private/deleted video — notify user | | "Sign in to confirm" | Age-restricted — try with `--cookies-from-browser chrome` | | Geographic restriction | Try with `--geo-bypass` | | Rate limited | Wait 30s and retry once | | Merge failed | Fallback to `-f best` (single stream) | ``` ### Technical Analysis The documented error-handling flow instructs the Agent to use `yt-dlp --cookies-from-browser chrome` when a website requests authentication. This option reads authentication cookies from a local Chrome profile and can use those cookies in requests made by `yt-dlp`. Browser cookies are sensitive authentication material. They can represent active sessions and provide access to accounts, private content, subscription features, viewing history, or age-verified services. Accessing the user's normal browser profile exceeds the permissions needed to download public media. The instruction does not require explicit informed consent, identify which Chrome profile will be accessed, limit cookie use to a dedicated account, or warn that authenticated requests may be made under the user's identity. ### Attack Path 1. A user or attacker supplies a supported URL that produces a sign-in or age-verification challenge. 2. The initial unauthenticated download fails. 3. Following the error table, the Agent retries with `--cookies-from-browser chrome`. 4. `yt-dlp` accesses the local Chrome cookie database and extracts cookies applicable to the target service. 5. The Agent makes an authenticated request using the user's active browser session. 6. Content unavailable to anonymous users may be retrieved, while the service records activity under the user's authenticated account. If combined with unsafe command executio ...[truncated 925 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Remove `--cookies-from-browser chrome` as an automatic error-handling fallback. - Require explicit, informed confirmation before accessing any browser profile or authenticated session. - Clearly state which service and browser profile will be accessed and that requests will occur under the user's identity. - Prefer public, unauthenticated downloads whenever possible. - If authentication is necessary, use a dedicated least-privilege browser profile or service account containing no unrelated sessions. - Restrict authenticated downloads to an exact allowlist of normalized hostnames. - Do not copy, log, persist, or transmit extracted cookies. - Run the downloader in an isolated environment that cannot access the user's primary browser profile by default. - Record an auditable consent event before enabling credential access. - Refuse the operation when consent, profile isolation, or domain validation cannot be established. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Natural-Language Policy Violations

High

• Confidence: 98% confidence
• Finding: The description uses language like 'metadata scrubbed clean' and 'No traces, no evidence,' which overtly promotes concealment and evidence removal. In the context of an automated downloader and file-forwarding skill, this materially raises concern that the skill is designed to help users obscure origin and accountability rather than simply download media.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

---
name: dwnldr
description: "Yarr! Plunder videos from the seven seas of the internet — YouTube, TikTok, Instagram, X, Reddit & 1000+ ports o' call. Drop a link, get full quality loot with metadata scrubbed clean. No traces, no evidence, just pure content booty delivered straight to yer Telegram. Supports MP4, MP3, playlists, and more."
metadata:
  openclaw:
    emoji: "🏴‍☠️"
    trigger: "/dl"
    requires:
      bins:
        - yt-dlp
        - ffmpeg
---

# Video Downloader

Download videos from **YouTube, TikTok, Instagram, Twitter/X**, and 1000+ sites. Just paste a link — the video gets dow

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

f "bestvideo[ext=mp4]+bestaudio[ext=m4a]/best[ext=mp4]/best" \
  --merge-output-format mp4 \
  --output "/home/rami/.openclaw/workspace/_incoming/%(title).50s.%(ext)s" \
  "<URL>"
```

Remove `--no-playlist` flag for playlists.

## Error Handling

| Error | Fix |
|-------|-----|
| "Video unavailable" | Private/deleted video — notify user |
| "Sign in to confirm" | Age-restricted — try with `--cookies-from-browser chrome` |
| Geographic restriction | Try with `--geo-bypass` |
| Rate limited | Wait 30s and retry once |
| Merge failed | Fallback to `-f best` (single stream) |

## Callback Reference

| callback_data | Action |
|---------------|--------|
| `dl:another` | Prompt for another URL |
| `dl:localsend` | Send last downloaded file via LocalSend |
| `dl:delete` | Delete the downloaded file |
| `dl:audio` | Re-download as MP3 |

## CLI Reference

| Command | Usage |
|---------|-------|
| Best quality | `yt-dlp -f "bestvideo+bestaudio/best" --merge-output-format mp4 URL` |
| Audio

• Confidence: 91% confidence
• Finding: The `cookies-from-browser chrome` instruction matches information-stealer patterns because it directs the tool to extract browser-resident authentication material. Although the apparent goal is downloading age-restricted media rather than stealing credentials, the technique still touches sensitive session data and could be abused to access protected content.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to auto-trigger on matching URLs and immediately perform downloads, file writes, and onward transmission without confirming user intent or warning about external network access. This increases the risk of unintended actions, SSRF-like retrieval of attacker-chosen resources through supported domains, and surprise exfiltration of content to Telegram or LocalSend.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The metadata-stripping step intentionally removes provenance fields such as source URL, timestamps, and creator information without prominently warning the user. This can facilitate misuse by erasing attribution and traceability, and it may destroy information users expect to preserve for compliance, auditing, or evidentiary purposes.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly recommends `--cookies-from-browser chrome` to bypass age restrictions, which expands behavior from media downloading into accessing local browser session data. Even if intended as a convenience workaround, this creates unnecessary exposure of authenticated cookies and could enable access to private or account-scoped content beyond the downloader's stated purpose.