ClawHub
Back to skill

Security audit

Video Downloader

Security checks for vulnerabilities and agentic risk

Overview

This is a real video downloader, but it needs Review because it can automatically install an unpinned package and download or write files with too little user-facing scoping.

Install only if you are comfortable with the skill using network access to download media and writing files to chosen paths. Before use, install yt-dlp yourself from a trusted source, avoid running the skill as an administrator, and only download content you have rights and permission to save.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
scripts/download.py:19
Finding

Automatic Installation of an Unpinned Third-Party Dependency

Content
View full analysis

Vulnerability Details

File Location: scripts/download.py, lines 19-26
Vulnerability Type: Uncontrolled runtime dependency installation
Risk Level: Medium

Vulnerable Code

python
def install_yt_dlp():
    """Install yt-dlp."""
    print("Installing yt-dlp...")
    try:
        subprocess.run(['pip', 'install', 'yt-dlp'], check=True)
        return True
    except:
        print("Error: Could not install yt-dlp")
        return False

The vulnerable function is automatically reached through the following dependency check at lines 100-103:

python
# Check dependencies
if not check_dependencies():
    if not install_yt_dlp():
        return 1

Technical Analysis

When yt-dlp is not found, the script automatically invokes pip install yt-dlp. It does not pin an approved version, verify a package hash, constrain the package index, or require explicit user confirmation.

Consequently, the package selected at execution time may differ from the package that existed when the Skill was audited. Package resolution can also be influenced by pip configuration, environment variables, index configuration, or compromise of the upstream distribution channel. Python package installation may run package-controlled build or installation logic with the privileges of the user executing the Skill.

The script calls the pip executable by name rather than using sys.executable -m pip. This also creates ambiguity about which Python environment receives the dependency and relies on executable resolution through the process environment.

Attack Path

  1. A user invokes scripts/download.py in an environment where the yt-dlp executable is unavailable or its version check fails.
  2. check_dependencies() returns False.
  3. The script automatically runs pip install yt-dlp without asking for approval.
  4. Pip resolves the latest available package through its active index and configuration, without a pinned version or verified hash.
  5. If pa ...[truncated 936 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove automatic dependency installation from normal runtime behavior. If yt-dlp is unavailable, fail with a clear message and direct the user to an explicit installation process.
  2. Declare yt-dlp in a reviewed dependency manifest or lockfile and pin an approved version.
  3. Use hash-verified installation, such as a requirements file containing exact versions and --hash entries together with pip --require-hashes.
  4. Install dependencies during a controlled build or deployment stage from a trusted, explicitly configured package index.
  5. Periodically review and update the pinned version through a controlled dependency-update process.
  6. If runtime installation is unavoidable, require explicit user confirmation, constrain the package source and version, verify integrity, and invoke pip through the intended interpreter:
python
subprocess.run(
    [
        sys.executable,
        "-m",
        "pip",
        "install",
        "--require-hashes",
        "-r",
        "requirements.txt",
    ],
    check=True,
)
  1. Run the Skill with least privilege and avoid executing it as an administrator or root user.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises shell-based execution via python scripts/download.py ... but does not declare any permissions or allowed-tools scope. That mismatch can cause the runtime or reviewer to underestimate the skill's capabilities, increasing the risk of unintended command execution or review bypass when the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description uses broad trigger language like 'Use when user needs to download videos for offline viewing, extract audio from videos, or save video metadata,' which can match many ordinary requests. Over-broad activation increases the chance the skill is selected in situations where downloading third-party content is unnecessary, legally sensitive, or higher risk than safer alternatives.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill omits warnings about copyright, consent, privacy, and platform terms when downloading from YouTube and other third-party services. In this context, that omission is material because the skill directly facilitates copying content from external platforms, which can lead to policy violations, unauthorized retention of private material, or legal exposure.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 17)May include surrounding context.

python
def check_dependencies():
    """Check if yt-dlp is installed."""
    try:
        subprocess.run(['yt-dlp', '--version'], capture_output=True, check=True)
        return True
    except:
        return False

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
92% confidence
Finding

Automatically running pip install yt-dlp executes package installation at runtime and trusts the system pip from PATH, which can lead to arbitrary code execution via a malicious pip binary, compromised package source, or dependency-install side effects. In an agent skill context this is more dangerous because a simple user request can trigger network access and code installation on the host without explicit operator approval.

Content

Scanner excerpt · scripts/download.py (reported line 27)May include surrounding context.

python
"""Install yt-dlp."""
    print("Installing yt-dlp...")
    try:
        subprocess.run(['pip', 'install', 'yt-dlp'], check=True)
        return True
    except:
        print("Error: Could not install yt-dlp")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 38)May include surrounding context.

python
"""List available formats."""
    try:
        cmd = ['yt-dlp', '--list-formats', url]
        result = subprocess.run(cmd, capture_output=True, text=True)
        print(result.stdout)
        return 0
    except Exception as e:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 84)May include surrounding context.

python
"""List available formats."""
    try:
        cmd = ['yt-dlp', '--list-formats', url]
        result = subprocess.run(cmd, capture_output=True, text=True)
        print(result.stdout)
        return 0
    except Exception as e:

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
88% confidence
Finding

This download execution runs an external tool on attacker-controlled URLs and optionally attacker-influenced output templates, which can write files to arbitrary user-specified paths and retrieve untrusted remote content. Although shell injection is avoided, in an agent environment this still creates meaningful risk of unsafe file writes, unexpected network access, and abuse of the host's yt-dlp capabilities.

Content

Scanner excerpt · scripts/download.py (reported line 73)May include surrounding context.

python
try:
        print(f"Downloading: {url}")
        result = subprocess.run(cmd)
        return result.returncode
    except Exception as e:
        print(f"Error: {e}")