Video Downloader

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill largely does what it advertises, but running it can automatically install an unpinned Python package if yt-dlp is missing.

Review this skill before installing because it can automatically run pip install yt-dlp if the dependency is missing. If you use it, prefer installing a pinned yt-dlp version yourself in a virtual environment and choose download output paths deliberately.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Running the skill may modify the user's Python environment and execute third-party package installation code before downloading anything.

Why it was flagged

If yt-dlp is missing, the script automatically installs it from pip at runtime. The dependency is not pinned and the registry metadata declares no install spec or required binaries, so this package-install behavior is under-disclosed.

Skill content

if not check_dependencies():
        if not install_yt_dlp():
            return 1
...
subprocess.run(['pip', 'install', 'yt-dlp'], check=True)

Recommendation

Declare yt-dlp as a dependency, pin a reviewed version, and require explicit user confirmation or a documented setup step instead of automatic runtime installation.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The selected video service will be contacted, and downloaded files will be written according to the provided output template or the default title-based filename.

Why it was flagged

The skill passes a user-provided URL and optional output path to the yt-dlp command. This is expected for a video downloader and does not use shell=True, but it still writes files locally and contacts external video services.

Skill content

cmd = ['yt-dlp']
...
cmd.extend(['-o', output])
...
cmd.append(url)
...
result = subprocess.run(cmd)

Recommendation

Use URLs and output paths you trust, avoid sensitive/system directories, and review the destination before running downloads.