T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:267- Finding
Unnecessary Browser Session Cookie Access During Video Retrieval
- Content
View full analysis
" ``` ```bash yt-dlp \ --cookies-from-browser chrome \ --write-info-json \ --write-thumbnail \ --write-subs \ --write-auto-subs \ --sub-lang "zh-Hans,zh-CN,zh,en" \ -f "bv*+ba/best" \ -o "video_to_skill_workspace/raw/video.%(ext)s" \ "" ``` ```bash yt-dlp \ --cookies-from-browser chrome \ -f "best" \ -o "video_to_skill_workspace/raw/video.%(ext)s" \ "" ``` ### Technical Analysis All documented video-fetching paths instruct `yt-dlp` to read session cookies from the user's Chrome profile. This access is enabled even though public video metadata and public media normally require no authentication. Because the video URL is supplied by the user, the destination is not inherently trusted. When cookie extraction is enabled, `yt-dlp` can access browser credential storage and use cookies applicable to the requested destination. This grants the workflow access to authenticated browser state that exceeds the minimum privileges required for processing public videos. The instruction also conflicts with the Skill's stated prohibition against bypassing login or access restrictions. Even when the intent is only to support ordinary downloads, making authenticated cookie access the default can cause the Skill to operate with the user's logged-in privileges. ### Attack Path 1. An attacker or untrusted user supplies a video URL, redirecting URL, or authentication-requiring URL. 2. The Agent follows the documented command and invokes `yt-dlp --cookies-from-br ...[truncated 989 chars]- Remediation
View remediation