download-video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:22 AM UTC
• Version: 1.0.1

Overview

This video-downloader skill is mostly coherent, but it can use live browser session cookies for authenticated downloads without clear warning or consent.

Review before installing. Use this skill only when you explicitly want an agent to download media, and avoid the cookie options unless you understand that they let yt-dlp use your logged-in browser sessions. Prefer a dedicated low-privilege browser profile or unauthenticated downloads, and install dependencies in an isolated environment with pinned versions where practical.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:19

Finding

Unpinned yt-dlp Package Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:19-24
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

# macOS
brew install yt-dlp ffmpeg

# Cross-platform
pip install yt-dlp

Technical Analysis

The documented cross-platform installation command installs the current release of yt-dlp and its resolved dependencies without a version constraint, lockfile, package hash, or explicit trusted package index. Consequently, the code installed when a user follows these instructions can differ from the dependency state that was reviewed during this audit.

No evidence was found that the named package is malicious. Exploitation depends on a supply-chain event, such as compromise of a package release, maintainer account, package registry, or transitive dependency. If such an event occurs, installation or subsequent execution of the dependency could run attacker-controlled code under the invoking user's account.

Attack Path

1. An attacker compromises a future yt-dlp release, one of its dependencies, a maintainer account, or the package source used by the victim.
2. A user follows the Skill documentation and executes pip install yt-dlp.
3. pip resolves the uncontrolled current package release and its transitive dependencies.
4. The compromised package is installed in the selected Python environment.
5. Malicious code executes during an applicable installation hook or when the installed downloader is subsequently invoked by scripts/download.py.
6. The payload operates with the permissions of the user who installed or ran the package.

Impact Assessment

Successful exploitation could provide arbitrary code execution with the invoking user's privileges. The resulting scope may include access to files readable by that user, modification of writable files, use of the user's network access, theft of environment-based credent ...[truncated 311 chars]

Remediation

View remediation

Remediation Suggestions

• Pin yt-dlp to a specifically reviewed version instead of installing an unconstrained release.
• Maintain dependencies in a version-controlled requirements or lock file.
• Record and verify cryptographic hashes using a command such as pip install --require-hashes -r requirements.txt.
• Use an explicitly configured, trusted package index or an internally controlled artifact repository.
• Establish a process for reviewing, testing, and deliberately updating the pinned version.
• Document a version verification command and the expected version after installation.
• Where practical, install the dependency in an isolated virtual environment with only the permissions required to download media.

T08 · Insecure Dependencies

Warning

• Location: references/platform-tips.md:17

Finding

Unpinned Optional PO-Token Provider Installation Creates a Plugin Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: references/platform-tips.md:17-23
Vulnerability Type: Unpinned third-party plugin installation
Risk Level: Medium

Vulnerable Code Snippet:

bash

# Find yt-dlp's Python path
head -1 $(which yt-dlp)

# Install the plugin
/path/to/python -m pip install bgutil-ytdlp-pot-provider

Technical Analysis

The documentation instructs users to install bgutil-ytdlp-pot-provider without a fixed version, dependency lock, package hash, or explicit trusted index. As a plugin provider, the installed package may be loaded into the downloader's Python execution environment, where it can execute code with the downloader process's permissions.

The package name shown in the documentation is not demonstrated to be malicious. The security issue is that the installed implementation can change after this Skill has been reviewed. A compromised package release, maintainer account, registry, or transitive dependency could therefore introduce code that is absent from the audited project.

Attack Path

1. An attacker compromises the provider package, one of its dependencies, its publishing account, or the package source configured on the victim's system.
2. A user follows the platform-specific guidance and runs /path/to/python -m pip install bgutil-ytdlp-pot-provider.
3. pip downloads an uncontrolled current release and its dependency graph.
4. The package is installed into the Python environment used by yt-dlp.
5. The malicious component executes during an applicable installation hook or when yt-dlp discovers and loads the provider plugin.
6. The payload gains the same operating-system permissions and accessible resources as the user running yt-dlp.

Impact Assessment

Successful exploitation could result in arbitrary code execution under the invoking user's account. Potentially exposed resources include user-readable files, writable project or home-directory ...[truncated 407 chars]

Remediation

View remediation

Remediation Suggestions

• Clearly label the provider as optional and explain that it executes third-party code in the downloader's Python environment.
• Pin the provider and all transitive dependencies to reviewed versions.
• Supply a lock file with cryptographic hashes and require hash verification during installation.
• Document the canonical publisher and trusted package source so users can detect similarly named or spoofed packages.
• Prefer an isolated virtual environment dedicated to the downloader and plugin.
• Review provider updates before changing the pinned version, including publisher identity, release artifacts, and dependency changes.
• Where feasible, distribute a verified dependency manifest through the Skill rather than directing users to install the latest registry release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (18)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

ns

bash

python3 scripts/download.py "URL" -f 1080            # Max 1080p
python3 scripts/download.py "URL" -a                  # Audio only (MP3)
python3 scripts/download.py "URL" -F                  # List formats
python3 scripts/download.py "URL" --subs              # With subtitles
python3 scripts/download.py "URL" -o ~/Desktop        # Custom output dir
python3 scripts/download.py "URL" --cookies chrome    # Use browser cookies

Direct yt-dlp commands

For cases the script doesn't cover, use yt-dlp directly:

bash

# Download playlist
yt-dlp -P ~/Downloads/Videos "PLAYLIST_URL"

# Custom filename template
yt-dlp -o "%(uploader)s - %(title)s.%(ext)s" "VIDEO_URL"

# Download with subtitles in specific languages
yt-dlp --write-subs --sub-lang zh,en -P ~/Downloads/Videos "VIDEO_URL"

Troubleshooting

Most download failures fall into these categories:

Symptom	Fix
"Sign in required" or age-restricted	Add --cookies chrome to use browser

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · references/platform-tips.md (reported line 12)May include surrounding context.

Platform-Specific Tips

YouTube

High-Quality Downloads (1080p+)

YouTube restricts high-quality formats for non-authenticated requests. Solutions:

Option 1: Browser Cookies (Recommended)

bash

yt-dlp --cookies-from-browser chrome "VIDEO_URL"

Supported browsers: chrome, firefox, safari, edge, opera, brave

Option 2: PO Token Provider

For persistent high-quality access without browser dependency:

bash

# Find yt-dlp's Python path
head -1 $(which yt-dlp)

# Install the plugin
/path/to/python -m pip install bgutil-ytdlp-pot-provider

Age-Restricted Content

Requires authentication via cookies:

bash

yt-dlp --cookies-from-browser chrome "VIDEO_URL"

Bilibili

Best Quality

bash

# With authentication for high quality
yt-dlp --cookies-from-browser

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/download.py (reported line 63)May include surrounding context.

python

bool = False,
    use_cookies: str = None,
) -> int:
    """
    Download video from URL using yt-dlp.

    Args:
        url: Video URL
        output_dir: Output directory
        max_height: Maximum video height (e.g., 1080, 720)
        audio_only: Extract audio only (as MP3)
        list_formats: List available formats instead of downloading
        with_subs: Download subtitles
        use_cookies: Browser to extract cookies from (chrome, firefox, etc.)

    Returns:
        Exit code (0 for success)
    """
    if not check_yt_dlp():
        print("Error: yt-dlp is not installed")
        print("Install via: brew install yt-dlp  # or: pip install yt-dlp")
        return 1

    print(f"yt-dlp version: {get_yt_dlp_version()}")

    cmd = ["yt-dlp"]

    # List formats only
    if list_formats:
        cmd.extend(["-F", url])
        return subprocess.run(cmd).returncode

    # Output directory
    output_path = Path(output_dir).expanduser().resolve()
    output_path.mkdir(parents

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill invokes shell commands and package installation but does not declare any explicit tool scope or allowed-tools boundary. That increases the chance an agent may execute shell actions unexpectedly or with broader access than intended, especially since the skill includes networked downloads and filesystem writes.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger conditions are extremely broad, including any shared video URL and generic phrases like saving video or extracting audio. Overbroad activation can cause the agent to run download workflows in situations where the user did not clearly request execution, leading to unintended network access, content retrieval, or policy-sensitive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs use of browser cookies for authenticated downloads without clearly warning that this accesses sensitive session data from the user's browser. In an agent context, this can expose authenticated content and blur the line between legitimate session reuse and unauthorized access to private accounts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The guidance explicitly recommends --cookies-from-browser to access restricted or higher-quality content but provides no warning that this uses live authenticated browser session data. In a user-facing agent skill, that omission can normalize exporting or granting access to sensitive cookies, which may expose account sessions, private content access, or credentials if mishandled or logged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The age-restricted-content instructions tell users to authenticate via browser cookies without any privacy or account-security caveat. Because the skill is specifically intended to be triggered automatically for shared video URLs, this increases the chance that sensitive session-backed access is used casually without understanding the risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The Bilibili section advises authenticated downloads using browser cookies for higher quality but omits any warning about the sensitivity of those cookies. This can lead users to run authenticated extraction commands without considering that they are extending account trust to tooling that may access private data or leave traces in logs/history.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

For protected Twitter/X content, the instructions recommend browser cookies but do not explain that this leverages the user's authenticated session and may expose access to protected/private content. In an automation context, that omission can encourage overbroad use of privileged sessions for convenience.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The Instagram guidance states that most content requires authentication and shows --cookies-from-browser examples, but it does not warn about handling session cookies as sensitive secrets. This can mislead users into treating authentication as routine command-line input rather than privileged account access with privacy implications.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 30)May include surrounding context.

python

def check_yt_dlp() -> bool:
    """Check if yt-dlp is installed."""
    result = subprocess.run(
        ["which", "yt-dlp"], capture_output=True, text=True
    )
    return result.returncode == 0

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 38)May include surrounding context.

python

def get_yt_dlp_version() -> str:
    """Get yt-dlp version."""
    result = subprocess.run(
        ["yt-dlp", "--version"], capture_output=True, text=True
    )
    return result.stdout.strip() if result.returncode == 0 else "unknown"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 80)May include surrounding context.

python

# List formats only
    if list_formats:
        cmd.extend(["-F", url])
        return subprocess.run(cmd).returncode

    # Output directory
    output_path = Path(output_dir).expanduser().resolve()

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill supports '--cookies-from-browser', which can access authenticated browser session cookies unrelated to simple public video downloading. In this skill context, that expands capability into sensitive local credential/session access and could expose private account content or session tokens if misused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script exposes browser cookie extraction without an explicit warning or consent flow, despite touching highly sensitive browser-stored authentication material. In an agent skill, this is more dangerous because users may invoke it casually for downloading content without realizing it can read active login sessions from local browsers.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download.py (reported line 110)May include surrounding context.

python

cmd.append(url)

    print(f"\nCommand: {' '.join(cmd)}\n")
    result = subprocess.run(cmd)

    if result.returncode == 0:
        print(f"\nDownload completed!")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script hard-codes subtitle languages to "zh,en,ja", which imposes a language/locale constraint rather than letting the user choose. This is a natural-language policy concern because users who need other subtitle languages are not offered an opt-in or configurable alternative.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.