下载视频的技能

• Outcome: Review
• Latest audit: Sep 14, 2026 · 8:48 PM UTC
• Version: 1.0.0

Overview

This video downloader is generally aligned with its purpose, but it needs review because a normal download can automatically install or fetch executable tools without integrity checks or clear per-use consent.

Review before installing. Use this only in an environment where automatic package installation and video downloads are acceptable. Prefer installing reviewed versions of yt-dlp and ffmpeg yourself, avoid browser-cookie options unless you understand they expose logged-in session credentials to yt-dlp, and restrict output paths to folders you intend the tool to write to.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: download_video.py:66

Finding

Unpinned Runtime Installation of yt-dlp

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: download_video.py:24

Finding

Downloaded FFmpeg Binary Is Used Without Integrity Verification

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (10)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 82% confidence

Finding

The --cookies-from-browser examples instruct extraction of browser cookies from local browser profiles. Although this is a legitimate yt-dlp feature for authenticated downloads, browser cookies are sensitive credentials; normalizing their use in a skill increases the chance of credential misuse, over-collection, or leakage to commands, logs, or remote services.

Content

Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.

loads`

• 视频文件名自动从视频标题生成
• ffmpeg会自动下载到技能目录（.trae/skills/视频下载器/ffmpeg/）
• 较高质量的视频可能需要更长的下载时间和更多磁盘空间
• 某些网站可能需要使用浏览器cookies进行认证

使用浏览器cookies（可选）

对于需要登录的视频，可以使用浏览器cookies：

bash

yt-dlp "URL" --cookies-from-browser chrome
yt-dlp "URL" --cookies-from-browser edge
yt-dlp "URL" --cookies-from-browser firefox

常见问题

1. 403 Forbidden错误：YouTube等网站的反爬虫机制，可以尝试：

   • 更新yt-dlp：pip install --upgrade yt-dlp
   • 使用浏览器cookies
   • 筭待一段时间后重试

2. 视频质量不理想：尝试使用不同的格式选择器或使用浏览器cookies

3. ffmpeg下载失败：如果自动下载ffmpeg失败，可以手动下载并解压到技能目录的ffmpeg/文件夹

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill describes capabilities that require shell execution, network access, and likely environment access, but it declares no explicit tool scope or permissions. That makes the operational boundary unclear and increases the chance the agent invokes powerful actions without adequate review or sandboxing.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger description is broad enough to overlap with common user intents like 'save' or 'download video,' which can cause unintended invocation. In a skill that performs network access, package installation, and file writes, accidental activation materially increases security and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation says the skill will automatically download and install ffmpeg and yt-dlp, but it does not prominently warn users that this changes the local system and performs outbound network activity. Silent installation of executables and dependencies is risky because it expands trust to external sources and may bypass user expectations or enterprise controls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script silently downloads, extracts, moves, and deletes FFmpeg files on Windows without user disclosure or integrity verification. This creates supply-chain and unexpected file-modification risk: a content-download request can trigger installation of a large binary tool from the internet and write into the skill directory, which is especially sensitive in agent-managed environments.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · download_video.py (reported line 68)May include surrounding context.

python

def check_ytdlp():
    """Check if yt-dlp is installed, if not, install it"""
    try:
        subprocess.run(["yt-dlp", "--version"], capture_output=True, check=True)
        print("yt-dlp is already installed")
    except (subprocess.CalledProcessError, FileNotFoundError):
        print("Installing yt-dlp...")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Automatic pip installation without warning or confirmation is unsafe because it silently changes the user's environment and downloads executable package content from the network. In an agent skill, this is more dangerous than a normal CLI utility because the user may think they only requested a file download, not a software installation or upgrade.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 91% confidence

Finding

The script automatically installs or upgrades yt-dlp via pip without prior user approval. This causes execution of package installation logic and modifies the runtime environment, which is risky in an agent context because a simple download request can unexpectedly trigger code/package changes and pull unpinned code from external repositories.

Content

Scanner excerpt · download_video.py (reported line 72)May include surrounding context.

python

print("yt-dlp is already installed")
    except (subprocess.CalledProcessError, FileNotFoundError):
        print("Installing yt-dlp...")
        subprocess.run([sys.executable, "-m", "pip", "install", "--upgrade", "yt-dlp"], check=True)
        print("yt-dlp installed successfully")

def download_video(url, quality="1080p", output_dir=None, audio_only=False):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · download_video.py (reported line 115)May include surrounding context.

python

print(f"Quality: {quality}")
    print(f"Output directory: {output_dir}")
    
    subprocess.run(cmd, check=True)
    print("Download completed!")

def main():

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

整个技能名称、描述和使用说明均固定为中文，未声明这是面向特定中文用户群体的区域性技能，也未提供语言选择或用户 opt-in。按规则，这可能构成自然语言层面的语言/区域策略问题。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.