ClawHub
Back to skill

Security audit

Yt Dlp Downloader Skill

Security checks for vulnerabilities and agentic risk

Overview

This video downloader is coherent, but it needs review because it tells agents to use browser session cookies for YouTube by default and requests overly broad shell permissions.

Install only if you are comfortable with an agent running yt-dlp/ffmpeg, writing downloaded files locally, and potentially reading browser cookies for YouTube. Prefer trying downloads without cookies first, approve cookie access only when needed, use a dedicated browser profile if possible, and review any pip, brew, or sudo install commands before running them.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:29
Finding

Mandatory Browser Cookie Access for YouTube Downloads

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:126
Finding

Download Workflow Requests Unrestricted Shell Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:16
Finding

Unpinned Third-Party Package Installation and Update Instructions

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Rogue AgentSelf-Modification, Session Persistence
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (14)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
95% confidence
Finding

The README explicitly recommends --cookies-from-browser chrome, which causes yt-dlp to read browser cookies from the local profile to authenticate requests. Although this is a legitimate yt-dlp feature rather than malware, in a skill context it is sensitive because it encourages access to browser-stored session tokens without clear warning, potentially exposing account sessions or private content if mishandled.

Content

Scanner excerpt · README.md (reported line 65)May include surrounding context.

m/watch?v=xxx" | | Extract audio | "Extract audio from https://youtube.com/watch?v=xxx" | | Download with subtitles | "Download with subtitles https://youtube.com/watch?v=xxx" | | Specific quality | "Download in 720p https://youtube.com/watch?v=xxx" |

Example Conversations

You: Download this video https://www.youtube.com/watch?v=xxx

Cursor:

bash
yt-dlp -P "~/Downloads/yt-dlp" --cookies-from-browser chrome "https://www.youtube.com/watch?v=xxx"

Supported Sites

yt-dlp supports thousands of sites including:

  • YouTube / YouTube Music
  • Bilibili (B站)
  • Twitter / X
  • TikTok / Douyin (抖音)
  • Vimeo
  • Twitch
  • And many more...

Troubleshooting

ErrorSolution
HTTP 403 Forbidden (YouTube)Use --cookies-from-browser chrome
yt-dlp not foundRun pip install yt-dlp
ffmpeg not foundRun brew install ffmpeg
Download failsRun `pip install -U yt-dl

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
90% confidence
Finding

The documented use of --cookies-from-browser chrome matches credential/session access behavior because it instructs the tool to read browser cookies from the user's Chrome profile. In this skill context, that is more dangerous because an AI agent may normalize or automate the command, causing users to expose authenticated session material without understanding the sensitivity or downstream handling.

Content

Scanner excerpt · README_CN.md (reported line 65)May include surrounding context.

��载这个视频 https://youtube.com/watch?v=xxx" | | 提取音频 | "提取音频 https://youtube.com/watch?v=xxx" | | 下载字幕 | "下载视频和字幕 https://youtube.com/watch?v=xxx" | | 指定画质 | "下载 720p https://youtube.com/watch?v=xxx" |

对话示例

你： 下载这个视频 https://www.youtube.com/watch?v=xxx

Cursor：

bash
yt-dlp -P "~/Downloads/yt-dlp" --cookies-from-browser chrome "https://www.youtube.com/watch?v=xxx"

支持的网站

yt-dlp 支持上千个网站，包括：

  • YouTube / YouTube Music
  • Bilibili（B站）
  • Twitter / X
  • TikTok / 抖音
  • Vimeo
  • Twitch
  • 更多...

常见问题

错误解决方案
HTTP 403 Forbidden (YouTube)使用 --cookies-from-browser chrome
yt-dlp 未找到运行 pip install yt-dlp
ffmpeg 未找到运行 brew install ffmpeg
下载失败运行 pip install -U yt-dlp 更�

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

text

If not installed, install them first:
```bash
pip install yt-dlp
brew install ffmpeg  # macOS

Quick Start

Basic Download (Best Quality)

bash
yt-dlp -P "~/Downloads/yt-dlp" "VIDEO_URL"

YouTube Download (Recommended - with cookies)

YouTube often blocks direct downloads with 403 errors. Always use browser cookies for YouTube:

bash
yt-dlp -P "~/Downloads/yt-dlp" --cookies-from-browser chrome "YOUTUBE_URL"

Supported browsers: chrome, firefox, safari, edge, brave, opera

Download with Custom Output Path

bash
yt-dlp -P "/path/to/save" -o "%(title)s.%(ext)s" "VIDEO_URL"

Common Tasks

1. Download Video (Default - Best Quality)

bash
yt-dlp -P "~/Downloads/yt-dlp" "VIDEO_URL"

2. Extract Audio Only (MP3)

bash
yt-dlp -P "~/Downloads/yt-dlp" -x --audio-format mp3 "VIDEO_URL"

3. Download with Subtitles

bash
yt-dlp -P "~/Downloads/yt-dlp" --write-subs --sub-langs all "VIDEO_URL"

4. Download

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README advertises automatic handling of YouTube 403 errors via browser cookies but does not warn that --cookies-from-browser accesses locally stored browser session cookies, which may include authenticated session data. In an agent-skill context, users may follow examples without understanding the privacy and credential exposure implications, increasing the chance of unintended sensitive data access.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

Option 2: Manual installation

  1. Create the skill directory:
    bash
    mkdir -p ~/.cursor/skills/yt-dlp-downloader/scripts

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly promotes using browser cookies to bypass YouTube 403 errors but does not warn that this accesses authenticated browser session data. In an agent skill context, this is risky because users may not realize the command reads sensitive browser state, which could expose account/session information or normalize unsafe access to local credentials.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 26)May include surrounding context.

安装 ffmpeg（音频提取需要）

brew install ffmpeg # macOS

或者: sudo apt install ffmpeg # Linux

text

## 安装方法

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README_CN.md (reported line 26)May include surrounding context.

安装 ffmpeg（音频提取需要）

brew install ffmpeg # macOS

或者: sudo apt install ffmpeg # Linux

text

## 安装方法

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README_CN.md (reported line 41)May include surrounding context.

  1. 创建 skill 目录：

    bash
    mkdir -p ~/.cursor/skills/yt-dlp-downloader/scripts

  2. 从本仓库下载 SKILL.md 和 scripts/download.sh

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill tells the agent to use browser cookies for YouTube downloads but does not disclose to the user that this reads authenticated browser data. That omission prevents informed consent and can lead to unexpected access to private session material, especially in an agentic environment where users may not realize local browser state is being touched.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill repeatedly instructs use of --cookies-from-browser, which causes the agent to access authenticated browser cookie stores from the local machine. For a downloader skill, that reaches beyond the minimally necessary data access and can expose session-bearing credentials or private account context if the command output, logs, or downstream tooling mishandles them.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The workflow requires Shell permissions ['all', 'network'], where all is broader than necessary for downloading media. Overbroad execution privileges increase blast radius: if the skill is misused or combined with malicious input, it could read, modify, or execute unrelated local resources beyond downloading a file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow directs the agent to perform network downloads and local file writes without a user-facing notice about those side effects. In an automated toolchain, hidden network and filesystem actions reduce transparency and make it easier for a user to authorize behavior they did not fully understand.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The markdown instructs users to run pip install, brew install, and git clone commands that modify the local system, but it does not include any warning or disclosure about making system changes. For markdown files, potentially integrity-affecting behavior should be accompanied by a brief warning so users understand the impact before execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.