Video Downloader

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:01 AM UTC
• Version: 1.0.0

Overview

This video-downloader skill mostly does what it claims, but it can automatically install an unpinned third-party package at runtime without clear user-facing disclosure.

Review this skill before installing. It appears to be a straightforward yt-dlp wrapper, but only use it in an isolated environment or after installing a reviewed, pinned yt-dlp version yourself. Expect it to fetch remote media and write files locally, and confirm that you have permission to download the content.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: scripts/download.py:20
• Finding: Automatic Installation of an Unpinned Third-Party Dependency## Vulnerability Details **File Location**: `scripts/download.py`, lines 20–27 **Vulnerability Type**: Supply-chain risk caused by automatic installation of an unpinned dependency **Risk Level**: Medium **Complete Code Snippet**: ```python def install_yt_dlp(): """Install yt-dlp.""" print("Installing yt-dlp...") try: subprocess.run(['pip', 'install', 'yt-dlp'], check=True) return True except: print("Error: Could not install yt-dlp") return False ``` ### Technical Analysis When `yt-dlp` is unavailable, the application automatically invokes `pip install yt-dlp`. The dependency has no pinned version or integrity hash, so the effective code installed and executed can change without any corresponding change to the audited project. Package installation may execute package-controlled build or installation logic under the privileges of the user running the application. The selected package and source also depend on the invoking environment's pip configuration. This creates exposure to a compromised package release, compromised or malicious package index, unsafe mirror configuration, or other software supply-chain failures. The use of an argument list rather than `shell=True` prevents direct shell metacharacter injection through this particular call. The issue is the uncontrolled dependency retrieval and execution, not shell-command construction. ### Attack Path 1. An attacker compromises a dependency release or a package source used by the victim's pip configuration. 2. The user runs `scripts/download.py` in an environment where the `yt-dlp` executable is unavailable. 3. `check_dependencies()` fails, causing `install_yt_dlp()` to run automatically. 4. The script invokes `pip install yt-dlp` without a reviewed version constraint or integrity hash. 5. Pip retrieves the attacker-controlled or compromised package content. 6. Package-controlled installation or runtime c ...[truncated 578 chars]
• Remediation: ## Remediation Suggestions - Remove automatic package installation from normal application execution. If the dependency is missing, terminate safely and provide explicit setup instructions. - Declare `yt-dlp` in a dependency manifest or lock file and pin it to a reviewed version. - Use package hashes, such as pip's `--require-hashes`, to verify dependency integrity. - Install dependencies in an isolated virtual environment during a separate, explicit setup phase. - Use `sys.executable -m pip` rather than a bare `pip` executable when installation is explicitly requested, ensuring that the intended Python environment is targeted. - Restrict dependency retrieval to a trusted, authenticated package repository or approved internal mirror. - Add a controlled dependency-update process that reviews new versions before changing the pin and associated integrity hashes. - Document the dependency and installation behavior clearly in `SKILL.md`.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises shell-based execution via `python scripts/download.py ...` but does not declare any `permissions` or `allowed-tools` scope. That mismatch weakens least-privilege controls and can let an agent invoke shell capabilities without explicit policy review, which is risky for a skill that fetches remote content and may pass user-controlled URLs into command execution paths.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The documentation provides commands for downloading and storing remote media and metadata but omits user-facing warnings about privacy, copyright, storage location, and trust of remote content. That omission makes misuse more likely and reduces informed consent, especially because the skill supports broad platforms and persistent local output.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_dependencies():
    """Check if yt-dlp is installed."""
    try:
        subprocess.run(['yt-dlp', '--version'], capture_output=True, check=True)
        return True
    except:
        return False

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Auto-installing yt-dlp via pip introduces package installation and trust-on-first-use behavior into a runtime utility that otherwise only needs to download media. This increases attack surface through dependency confusion, compromised mirrors, malicious package updates, or unexpected execution of installer code in the current environment.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Install yt-dlp."""
    print("Installing yt-dlp...")
    try:
        subprocess.run(['pip', 'install', 'yt-dlp'], check=True)
        return True
    except:
        print("Error: Could not install yt-dlp")

• Confidence: 94% confidence
• Finding: The skill automatically installs and executes third-party software via pip at runtime, which expands behavior beyond simple video downloading and creates a supply-chain risk. If package indexes, dependency resolution, or the execution environment are compromised, this can result in installation and later execution of untrusted code.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""List available formats."""
    try:
        cmd = ['yt-dlp', '--list-formats', url]
        result = subprocess.run(cmd, capture_output=True, text=True)
        print(result.stdout)
        return 0
    except Exception as e:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""List available formats."""
    try:
        cmd = ['yt-dlp', '--list-formats', url]
        result = subprocess.run(cmd, capture_output=True, text=True)
        print(result.stdout)
        return 0
    except Exception as e:

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        print(f"Downloading: {url}")
        result = subprocess.run(cmd)
        return result.returncode
    except Exception as e:
        print(f"Error: {e}")

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Vague Triggers

Low

• Confidence: 91% confidence
• Finding: The description is broad enough to trigger on generic requests to 'download videos' or 'extract audio,' increasing the chance the skill is invoked in situations the user did not specifically intend. In a skill that downloads remote media, overbroad matching can lead to unnecessary network access, storage of content, or handling of copyrighted/private material without sufficient user confirmation.

Static analysis

No suspicious patterns detected.