Video Download FaaS

• Outcome: Review
• Latest audit: May 28, 2026 at 1:50 AM UTC
• Version:
  1.0.0

Overview

This is a functional video downloader, but it overstates isolation and has weak controls around background processes and temporary session files.

Install only if you are comfortable with local, long-running yt-dlp processes rather than proven container isolation. Use it on trusted URLs, avoid private or tokenized video links on shared machines, and only pass session IDs produced by this skill. Expect partial files if you force-kill downloads.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The skill says downloads continue running after disconnect and are saved to disk, but it does not present this as a clear safety warning or call out the privacy, storage, and resource-consumption implications. Users may unintentionally leave long-lived background processes and downloaded media on shared or sensitive systems, creating persistence and data-handling risks.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: Documenting force-kill functionality without warning about partial files, inconsistent state, or cleanup implications can lead users to interrupt downloads unsafely. This can leave orphaned temporary data, corrupted outputs, stale session metadata, or lingering operational confusion that affects later automation and storage hygiene.

VirusTotal

66/66 vendors flagged this skill as clean.