Video Downloader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:01 AM UTC
• Version: 1.0.0

Overview

This video-downloader skill mostly does what it claims, but it can automatically install an unpinned third-party package at runtime without clear user-facing disclosure.

Review this skill before installing. It appears to be a straightforward yt-dlp wrapper, but only use it in an isolated environment or after installing a reviewed, pinned yt-dlp version yourself. Expect it to fetch remote media and write files locally, and confirm that you have permission to download the content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/download.py:20

Finding

Automatic Installation of an Unpinned Third-Party Dependency

Content

View full analysis

Vulnerability Details

File Location: scripts/download.py, lines 20–27
Vulnerability Type: Supply-chain risk caused by automatic installation of an unpinned dependency
Risk Level: Medium

Complete Code Snippet:

python

def install_yt_dlp():
    """Install yt-dlp."""
    print("Installing yt-dlp...")
    try:
        subprocess.run(['pip', 'install', 'yt-dlp'], check=True)
        return True
    except:
        print("Error: Could not install yt-dlp")
        return False

Technical Analysis

When yt-dlp is unavailable, the application automatically invokes pip install yt-dlp. The dependency has no pinned version or integrity hash, so the effective code installed and executed can change without any corresponding change to the audited project.

Package installation may execute package-controlled build or installation logic under the privileges of the user running the application. The selected package and source also depend on the invoking environment's pip configuration. This creates exposure to a compromised package release, compromised or malicious package index, unsafe mirror configuration, or other software supply-chain failures.

The use of an argument list rather than shell=True prevents direct shell metacharacter injection through this particular call. The issue is the uncontrolled dependency retrieval and execution, not shell-command construction.

Attack Path

1. An attacker compromises a dependency release or a package source used by the victim's pip configuration.
2. The user runs scripts/download.py in an environment where the yt-dlp executable is unavailable.
3. check_dependencies() fails, causing install_yt_dlp() to run automatically.
4. The script invokes pip install yt-dlp without a reviewed version constraint or integrity hash.
5. Pip retrieves the attacker-controlled or compromised package content.
6. Package-controlled installation or runtime c ...[truncated 578 chars]

Remediation

View remediation

Remediation Suggestions

• Remove automatic package installation from normal application execution. If the dependency is missing, terminate safely and provide explicit setup instructions.
• Declare yt-dlp in a dependency manifest or lock file and pin it to a reviewed version.
• Use package hashes, such as pip's --require-hashes, to verify dependency integrity.
• Install dependencies in an isolated virtual environment during a separate, explicit setup phase.
• Use sys.executable -m pip rather than a bare pip executable when installation is explicitly requested, ensuring that the intended Python environment is targeted.
• Restrict dependency retrieval to a trusted, authenticated package repository or approved internal mirror.
• Add a controlled dependency-update process that reviews new versions before changing the pin and associated integrity hashes.
• Document the dependency and installation behavior clearly in SKILL.md.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises shell-based execution via python scripts/download.py ... but does not declare any permissions or allowed-tools scope. That mismatch weakens least-privilege controls and can let an agent invoke shell capabilities without explicit policy review, which is risky for a skill that fetches remote content and may pass user-controlled URLs into command execution paths.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation provides commands for downloading and storing remote media and metadata but omits user-facing warnings about privacy, copyright, storage location, and trust of remote content. That omission makes misuse more likely and reduces informed consent, especially because the skill supports broad platforms and persistent local output.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 17)May include surrounding context.

python

def check_dependencies():
    """Check if yt-dlp is installed."""
    try:
        subprocess.run(['yt-dlp', '--version'], capture_output=True, check=True)
        return True
    except:
        return False

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Auto-installing yt-dlp via pip introduces package installation and trust-on-first-use behavior into a runtime utility that otherwise only needs to download media. This increases attack surface through dependency confusion, compromised mirrors, malicious package updates, or unexpected execution of installer code in the current environment.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 94% confidence

Finding

The skill automatically installs and executes third-party software via pip at runtime, which expands behavior beyond simple video downloading and creates a supply-chain risk. If package indexes, dependency resolution, or the execution environment are compromised, this can result in installation and later execution of untrusted code.

Content

Scanner excerpt · scripts/download.py (reported line 27)May include surrounding context.

python

"""Install yt-dlp."""
    print("Installing yt-dlp...")
    try:
        subprocess.run(['pip', 'install', 'yt-dlp'], check=True)
        return True
    except:
        print("Error: Could not install yt-dlp")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 38)May include surrounding context.

python

"""List available formats."""
    try:
        cmd = ['yt-dlp', '--list-formats', url]
        result = subprocess.run(cmd, capture_output=True, text=True)
        print(result.stdout)
        return 0
    except Exception as e:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 84)May include surrounding context.

python

"""List available formats."""
    try:
        cmd = ['yt-dlp', '--list-formats', url]
        result = subprocess.run(cmd, capture_output=True, text=True)
        print(result.stdout)
        return 0
    except Exception as e:

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 73)May include surrounding context.

python

try:
        print(f"Downloading: {url}")
        result = subprocess.run(cmd)
        return result.returncode
    except Exception as e:
        print(f"Error: {e}")

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description is broad enough to trigger on generic requests to 'download videos' or 'extract audio,' increasing the chance the skill is invoked in situations the user did not specifically intend. In a skill that downloads remote media, overbroad matching can lead to unnecessary network access, storage of content, or handling of copyrighted/private material without sufficient user confirmation.

Content

No source excerpt is available for this finding.