YouTube Video Downloader

• Outcome: Review
• Latest audit: Jul 24, 2026 · 8:33 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it sends user-supplied URLs and an API key to a third-party service and requires unbounded verbatim output from that service.

Review before installing. Use this only with YouTube links you are authorized to download, understand that the URL and RedFox API key are sent to redfox.hk, avoid saving the key unless needed, and treat returned descriptions or links as untrusted external content.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The skill is advertised as triggerable via broad natural-language requests such as 'Download this video' or 'Help me save this Short' rather than a narrowly scoped command. This increases the chance of unintended activation or misuse in adjacent conversations, especially because the capability facilitates downloading third-party content with legal and policy sensitivity.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README promotes downloading, backing up, and remixing YouTube content without any warning about copyright, platform terms, or authorization requirements. In this context, the omission materially increases the risk that users will use the skill for infringing or non-compliant content acquisition, making the skill more dangerous than a generic file downloader.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script transmits both a user-supplied YouTube URL and the API key to the third-party service redfox.hk, but it does not provide a meaningful privacy or trust warning before doing so. In a skill context, this can surprise users and may expose sensitive viewing targets, internal URLs accidentally pasted by a user, or credentials to an external operator without informed consent.

Unbounded Output

Medium

• Category: Output Handling

Content

### Core Features

- **Video Parsing**: paste a YouTube video link to parse out watermark-free video download URLs (returned resources may include video and audio files in various formats).
- **Complete Information**: displays resource type, duration, download link, and cover link for every resolution; full description shown line by line without truncation.
- **Multi-Format Support**: recognizes regular videos, Shorts, and short links (youtu.be).

---

• Confidence: 71% confidence
• Finding: Promising to show the 'full description shown line by line without truncation' creates an unbounded output condition where very large metadata can be emitted directly. While not directly enabling code execution, it can cause excessive token usage, degraded agent performance, or inadvertent reproduction of large copyrighted text blocks or embedded prompt-like content from video descriptions.

Unbounded Output

Medium

• Category: Output Handling

Content

- **Output**: Returns the video download URL directly — copy it into your browser or download tool to save
- **Link Display Rule**: Download and cover links must be displayed in full; never use `...` or any form of truncation
- **Field Display Rule**: The returned result must fully display the following fields:
  - Description (desc): full text displayed line by line, no truncation
  - Resource list: for each resource object, display its type, duration (durationSeconds), download link (downloadUrl), and cover link (coverUrl)
  - When the API does not return a resources array, automatically fall back to extracting top-level fields with the same names for compatibility

• Confidence: 88% confidence
• Finding: The skill explicitly requires full, untruncated display of API-returned description text and links, creating an unbounded-output path from a third-party service into the agent's response. If the upstream API returns excessively large text, hostile strings, or embedded prompt-manipulation content in fields like desc, the agent may reveal or relay it verbatim, increasing token exhaustion and prompt-injection exposure.

Unbounded Output

Medium

• Category: Output Handling

Content

print(f"\n{GREEN}{BOLD}✓ Parsed successfully!{RESET}")

    # Full description (original text, no truncation)
    if desc:
        print(f"\n{CYAN}{BOLD}📝 Description:{RESET}")
        for line in str(desc).splitlines():

• Confidence: 78% confidence
• Finding: The script prints unbounded description text and, in some error paths, potentially large raw JSON responses from a remote service directly to the terminal. A malicious or compromised API could return extremely large output or terminal control sequences, causing log flooding, degraded usability, or terminal escape injection effects in downstream consumers.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- **Content Type**: Video/Audio (MP4 / WebM / M4A and other formats; resources may include video and audio files)
- **Input**: Paste a YouTube video link (one link per request; batch upload not supported)
- **Output**: Returns the video download URL directly — copy it into your browser or download tool to save
- **Link Display Rule**: Download and cover links must be displayed in full; never use `...` or any form of truncation
- **Field Display Rule**: The returned result must fully display the following fields:
  - Description (desc): full text displayed line by line, no truncation
  - Resource list: for each resource object, display its type, duration (durationSeconds), download link (downloadUrl), and cover link (coverUrl)

• Confidence: 84% confidence
• Finding: The 'Display Rule' language instructs the agent to fully reproduce fields from external API responses, which encourages direct prompt extraction and reproduction of untrusted content without filtering. Because these fields originate from a third-party service and may be attacker-controlled or compromised, they can carry prompt-injection payloads, tracking URLs, or misleading instructions that the agent is told to surface in full.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

- **Input**: Paste a YouTube video link (one link per request; batch upload not supported)
- **Output**: Returns the video download URL directly — copy it into your browser or download tool to save
- **Link Display Rule**: Download and cover links must be displayed in full; never use `...` or any form of truncation
- **Field Display Rule**: The returned result must fully display the following fields:
  - Description (desc): full text displayed line by line, no truncation
  - Resource list: for each resource object, display its type, duration (durationSeconds), download link (downloadUrl), and cover link (coverUrl)
  - When the API does not return a resources array, automatically fall back to extracting top-level fields with the same names for compatibility

• Confidence: 84% confidence
• Finding: This second display-rule instance further reinforces mandatory full disclosure of external content, including descriptions and resource metadata, making the agent more likely to echo attacker-supplied text directly into the conversation. In context, the skill depends on a third-party parsing API, so requiring complete reproduction of response fields materially increases prompt-injection and data-handling risk.

Static analysis

No suspicious patterns detected.