Yt Dlp Downloader Skill

• Analyzed: May 7, 2026, 5:56 AM
• Findings: 1
• Version: 1.0.2
• Hash: 8dd55640e8b37ba22429bf1d382508e9803ba601a2065678807f56b8b7d1841f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a wrapper for the yt-dlp utility and includes a helper script `scripts/download.sh` that uses best practices like array-based command execution and basic input validation to prevent shell injection. However, it is classified as suspicious because the `SKILL.md` instructions explicitly direct the AI agent to access sensitive user data via the `--cookies-from-browser` flag to bypass YouTube's anti-bot measures. While this is a standard feature of yt-dlp, instructing an automated agent to access browser cookies and requesting broad shell permissions (`required_permissions: ["all"]`) constitutes a high-risk behavior, even if plausibly needed for the stated purpose.