Yt Dlp Download Skill

This skill appears to do what it claims (use yt-dlp to download media), but it includes a helper script that builds a shell command and runs it via eval without validating URLs. That creates a command-injection risk: a maliciously crafted URL could cause arbitrary commands to run. Before installing or enabling this skill: - Inspect or replace scripts/download.sh. Prefer invoking yt-dlp with an argument array (no eval) or use bash exec with properly quoted parameters. Validate the URL scheme (http/https) and reject or sanitize unexpected characters (quotes, semicolons, backticks). - If you still want to use it, do not enable autonomous invocation for this skill (require user confirmation before any download), or run it in a strict sandbox/container. - Be cautious about the '--cookies-from-browser' behavior: it can access browser cookies if yt-dlp can read them — only use when you understand and consent to that. - If you lack the ability to audit/patch the script, prefer running yt-dlp manually or using an alternative skill with safer command invocation. If you proceed, apply the minimal-privilege principle and only enable the skill for trusted users/contexts.