yt-dlp

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:35 AM UTC
• Version: 1.0.0

Overview

This is a disclosed YouTube music downloader, but its command templates could let a crafted song request run unintended local shell commands.

Review this skill before installing. It is small and its music-downloader behavior is disclosed, but only use it where the agent will ask before downloading, treat song titles and artists as untrusted input, and execute yt-dlp/find with safely separated arguments or robust escaping. Pin or otherwise control the yt-dlp package source if you need reproducible installs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:5

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 5
Vulnerability Type: Unpinned dependency installation
Risk Level: Medium

Vulnerable Code

yaml

metadata: {"clawdbot":{"emoji":"📥","requires":{"bins":["yt-dlp","ffmpeg"]},"install":[{"id":"apt-ffmpeg","kind":"apt","formula":"ffmpeg","bins":["ffmpeg"],"label":"Install ffmpeg (apt)"},{"id":"pip-yt-dlp","kind":"pip","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (pip)"}]}}

Technical Analysis

The installation metadata requests the yt-dlp package from the configured Python package index without specifying an audited version or an integrity hash. Consequently, the code installed for this skill can change after the skill itself has been reviewed.

This creates a supply-chain risk because package resolution depends on mutable external repository state. If the package index, a future release, a transitive dependency, or the local package-source configuration is compromised, installation could introduce attacker-controlled code.

Attack Path

1. An attacker compromises a future yt-dlp release, one of its resolved dependencies, or the package source used by the environment.
2. The skill installation process resolves the unpinned yt-dlp package.
3. The installer retrieves the compromised package or dependency.
4. Attacker-controlled package code is installed and subsequently runs during installation or normal skill use.
5. That code operates with the privileges of the account performing the installation or invoking the package.

Impact Assessment

Successful exploitation could execute arbitrary code with the privileges of the installing or invoking user. The resulting access may include reading or modifying that user's files, accessing available environment variables and credentials, making network requests, and altering other user-level applications. No evidence shows that this skill itself requests elevated or root privile ...[truncated 29 chars]

Remediation

View remediation

Remediation Suggestions

• Pin yt-dlp to a specific version that has been reviewed, rather than resolving the latest available release.
• Use a lock file or equivalent installation manifest containing cryptographic hashes.
• Enforce hash verification, such as pip's --require-hashes workflow where supported.
• Retrieve packages only from an explicitly approved package index.
• Review and pin transitive dependencies when the installation method does not otherwise guarantee reproducibility.
• Run package installation and media processing under a dedicated, least-privileged account or sandbox.
• Establish a controlled update process in which dependency upgrades are reviewed and tested before deployment.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:21

Finding

Shell Command Injection Through Unsanitized Request-Derived Values

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 21 and 29
Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

markdown

2. **Check Local:** Search the workspace music folder: `find ~/.openclaw/workspace/music/ -type f -iname "*<keyword>*"`

- `mkdir -p ~/.openclaw/workspace/music/ && cd ~/.openclaw/workspace/music/ && yt-dlp -x --audio-format mp3 -o "%(title)s.%(ext)s" "ytsearch1:<Exact Track Name> <Artist>"`

Technical Analysis

The documented workflow instructs the agent to insert values derived from a user's song request into shell command strings. The keyword, track name, and artist values are shown inside double-quoted shell arguments, but no validation or shell-safe escaping procedure is required.

Double quotes do not neutralize every shell construct. If the agent performs literal text substitution and executes the resulting command through a shell, request-derived quotation marks, command substitutions, or other shell syntax could terminate or alter the intended argument. The shell may then interpret attacker-controlled content as commands rather than as inert search text.

Both the local find operation and the yt-dlp search command expose this pattern. The latter is especially significant because it appears in a compound shell command containing directory creation and directory changes.

Attack Path

1. An attacker supplies a crafted song title, artist, lyrics query, or search keyword containing shell-significant syntax.
2. The agent identifies that attacker-controlled value as the keyword, exact track name, or artist.
3. Following the skill instructions, the agent substitutes the value into one of the documented shell command templates.
4. The command is passed to a shell without robust argument separation or escaping.
5. The shell interprets part of the supplied value as executable syntax.
6. The injected com ...[truncated 951 chars]

Remediation

View remediation

Remediation Suggestions

• Do not construct shell command strings by interpolating request-derived values.
• Invoke find and yt-dlp through APIs that accept an executable and a separate argument array, with shell processing disabled.
• Pass the complete search expression as a single argument to find, and pass the complete ytsearch1: query as a single argument to yt-dlp.
• If shell execution is unavoidable, apply a well-tested shell-escaping routine independently to every dynamic value; do not rely on surrounding values with double quotes.
• Validate track names, artist names, and keywords against a conservative character and length policy before command execution.
• Reject control characters, unexpected line breaks, and shell metacharacters where they are not required for legitimate music searches.
• Execute media-download operations in a sandbox with restricted filesystem access, minimal environment variables, no unnecessary credentials, and constrained network access.
• Verify that the final resolved output path remains under ~/.openclaw/workspace/music/ before passing it to another skill or application.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly instructs the agent to perform a network download from YouTube and write the resulting file into the user's workspace, but it does not require any user-facing notice or confirmation before external access and file creation. In an agent setting, this can cause unexpected network activity, unreviewed content ingestion, and silent modification of local state, especially if triggered from an ambiguous music request.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

## yt-dlp quick start

Ensure the directory exists, navigate to it, and download the missing track. The `ytsearch1:` prefix is used to grab the best match from YouTube Music/YouTube automatically:
- `mkdir -p ~/.openclaw/workspace/music/ && cd ~/.openclaw/workspace/music/ && yt-dlp -x --audio-format mp3 -o "%(title)s.%(ext)s" "ytsearch1:<Exact Track Name> <Artist>"`

## Notes
- **Post-Download Action:** Always wait for the download to finish, then run `find` again to capture the final filename (as `yt-dlp` sanitizes titles) before passing it to `cmus`.

Static analysis

No suspicious patterns detected.