yt-dlp-cli

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:01 AM UTC
• Version: 0.1.2

Overview

This skill is a scoped guide for using yt-dlp and ffmpeg to save requested media, with explicit limits around playlists, rights, cookies, and secrets.

Install through a trusted OpenClaw/Hermes path when possible, or pin and verify any npx installer you choose to run. When using the skill, approve browser-cookie or cookie-file access only for a specific site and download, and do not use it for media you do not have rights to save.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:24

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: README.md:24
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

The installation documentation instructs users to execute an npm package through npx without pinning the package to a reviewed version or verifying its integrity:

bash

npx skills add tmchow/agent-skills --skill yt-dlp-cli

Technical Analysis

When the skills package is not already installed locally, npx can retrieve and execute it from the configured npm registry. Because the command does not specify an exact version or integrity hash, the code executed at installation time may differ from the code available when this project was audited.

This creates a supply-chain trust boundary outside the audited repository. A compromised maintainer account, malicious future package release, registry compromise, or unsafe registry configuration could cause the command to execute attacker-controlled package lifecycle scripts or CLI code.

The project itself does not contain an embedded malicious payload, and exploitation depends on compromise or substitution of the external package.

Attack Path

1. An attacker compromises the npm package, its publisher account, the package distribution channel, or a registry used by the victim.
2. The attacker publishes a malicious version that is selected by the unpinned npx skills invocation.
3. A user follows the installation instructions and runs the documented command.
4. npx downloads and executes the attacker-controlled package.
5. The malicious package runs with the permissions of the invoking user.

Impact Assessment

Successful exploitation could allow arbitrary code execution with the installing user's privileges. Depending on that user's access, the malicious package could read or modify user-accessible files, steal environment credentials, alter development projects, install additional user-level components, or make network req ...[truncated 267 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the installer package to a specific, reviewed version, for example:

   bash

   npx --yes skills@<reviewed-version> add tmchow/agent-skills --skill yt-dlp-cli
   

2. Record the dependency in a lockfile where practical and preserve npm integrity metadata.
3. Document the expected official package publisher and registry so users can verify the package source before execution.
4. Prefer installation workflows that verify package signatures, checksums, or provenance attestations.
5. Review and test each pinned update before changing the documented version.
6. In CI or other sensitive environments, install dependencies in an isolated, least-privileged environment with restricted credentials and filesystem access.

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · references/youtube-auth.md (reported line 17)May include surrounding context.

yt-dlp --version

text

If the install method does not support self-update, update through the
package or binary source that installed `yt-dlp`. Done when a newer or
already-current version is confirmed.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.