video-download

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:36 PM UTC
• Version: 0.1.6

Overview

This video download skill is mostly purpose-aligned, but it can use browser or cookie-file authentication with unrestricted URLs and can unexpectedly fall back from subtitle-only mode to full video download and transcription.

Review this skill before installing. Use it only in an isolated environment or with narrowly scoped cookies, avoid raw Cookie headers when possible, and do not point it at untrusted URLs while authentication data is enabled. Be aware that subtitle-only mode may still download and process full videos if subtitles are unavailable.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:13

Finding

Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:13-17 and SKILL.md:56-67
Vulnerability Type: Unpinned Python dependencies and model artifacts
Risk Level: Medium

Vulnerable Code

json

"install": [
  {
    "id": "pip",
    "kind": "pip",
    "packages": ["yt-dlp", "yt-dlp-ejs", "ffmpeg-python", "faster-whisper", "tqdm"],
    "label": "Install dependencies (pip)",
  }
]

bash

pip install yt-dlp yt-dlp-ejs ffmpeg-python faster-whisper tqdm

Technical Analysis

The Skill installs five Python packages without exact version constraints or cryptographic integrity hashes. As a result, each installation may resolve to different package and transitive dependency versions. Package installation can execute package build hooks or other installer-time code with the privileges of the user running the Skill installation.

The documentation also states that Faster Whisper downloads model artifacts from Hugging Face on first use. No model revision or artifact hash is specified. Although there is no evidence that any named dependency is currently malicious, the effective dependency set and model artifacts can change after this Skill version has been reviewed.

Attack Path

1. An attacker compromises a dependency, transitive dependency, package publishing account, package index, or remotely retrieved model artifact.
2. A user installs or reinstalls the Skill dependencies using the unpinned package list.
3. The package manager resolves the compromised or unsafe release because no reviewed version or hash is enforced.
4. Malicious installer or runtime code executes under the privileges of the user running the Skill.
5. The code may access files, credentials, network resources, or other data available to that user.

Impact Assessment

Successful supply-chain exploitation could provide arbitrary code execution with the privileges of the installing or executing user. The scope could in ...[truncated 243 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every direct dependency to a reviewed, exact version.
• Maintain a lock file that also constrains transitive dependencies.
• Require cryptographic hashes during installation, such as through pip's --require-hashes.
• Install only from explicitly trusted package indexes.
• Audit dependency updates before changing pinned versions.
• Pin Faster Whisper model identifiers to reviewed revisions and verify downloaded artifact hashes where supported.
• Perform installation and execution in a restricted virtual environment or container without unnecessary credentials.
• Add automated dependency vulnerability and provenance scanning to the release process.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/video_parser.py:202

Finding

Caller-Controlled URLs Can Be Combined with Access to Sensitive Browser or File-Based Cookies

Content

View full analysis

Vulnerability Details

File Location: scripts/video_parser.py:202-227 and scripts/video_parser.py:326-360
Vulnerability Type: Excessive authentication-data access and unrestricted network destinations
Risk Level: Medium

Vulnerable Code

python

urls = params.get("urls", [])
output_path = params.get("output", "./downloads")
onlysubtitle = params.get("onlysubtitle", False)
cookie = params.get("cookie", "")
cookiesfrombrowser = params.get("cookiesfrombrowser", "")
cookiefile = params.get("cookiefile", "")

if not urls:
    return {"success": False, "message": "URL列表为空", "results": []}
if not onlysubtitle:
    return {"success": False, "message": "onlysubtitle=false，不执行仅字幕下载逻辑", "results": []}

os.makedirs(output_path, exist_ok=True)

results = []
success_count = 0

base_opts = {"format": "bestvideo+bestaudio/best"}
if cookie:
    base_opts["http_headers"] = {"Cookie": cookie}
if cookiesfrombrowser:
    base_opts["cookiesfrombrowser"] = (cookiesfrombrowser,)
if cookiefile:
    base_opts["cookiefile"] = cookiefile

The full-download path implements the same capability:

python

urls = params.get("urls", [])
output_path = params.get("output", "./downloads")
model_name = params.get("model", "small")
transcribe = params.get("transcribe", True)
subtitle_format = params.get("subtitle_format", "txt")
download_subtitle = params.get("download_subtitle", False)
overwrite_subtitle = params.get("overwrite_subtitle", True)
cookie = params.get("cookie", "")
cookiesfrombrowser = params.get("cookiesfrombrowser", "")
cookiefile = params.get("cookiefile", "")

if cookie:
    ydl_opts['http_headers'] = {
        'Cookie': cookie
    }
if cookiesfrombrowser:
    ydl_opts['cookiesfrombrowser'] = (cookiesfrombrowser,)
if cookiefile:
    ydl_opts['cookiefile'] = cookiefile

Technical Analysis

The invocation JSON controls both the destination URLs and th ...[truncated 2255 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, per-invocation user confirmation before reading browser cookies or a cookie file.
• Do not accept raw Cookie headers unless strictly necessary; prefer a domain-scoped cookie jar.
• Validate URL schemes and allow only https by default.
• Apply a destination-host allowlist when authentication data is enabled.
• Reject loopback, link-local, private-network, and cloud metadata destinations after DNS resolution and after every redirect.
• Restrict cookiesfrombrowser to a documented allowlist of supported browser identifiers and profiles.
• Restrict cookie files to user-approved paths and reject symlinks or unexpected file types.
• Separate public downloads from authenticated downloads into distinct execution modes.
• Run authenticated downloads in an isolated process with minimum filesystem and network permissions.
• Avoid passing secrets in command-line JSON because command lines may be recorded in shell history or exposed through process inspection.
• Redact cookie values and sensitive paths from logs and error messages.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/video_parser.py:593

Finding

Subtitle-Only Mode Silently Falls Back to Full Video Download and Transcription

Content

View full analysis

Vulnerability Details

File Location: scripts/video_parser.py:593-617
Vulnerability Type: Undeclared expansion of requested operation and resource privileges
Risk Level: Medium

Vulnerable Code

python

if cli_params.get("onlysubtitle", False):
    subtitle_result = download_subtitle(json_input)
    failed_urls = [
        item.get("url")
        for item in subtitle_result.get("results", [])
        if item.get("url") and (
            not item.get("subtitle_path") or not os.path.exists(item.get("subtitle_path"))
        )
    ]

    if failed_urls:
        fallback_params = dict(cli_params)
        fallback_params["urls"] = failed_urls
        fallback_params["onlysubtitle"] = False
        fallback_result = download_videos(json.dumps(fallback_params, ensure_ascii=False))
        result = {
            "success": subtitle_result.get("success", False) or fallback_result.get("success", False),
            "message": (
                f"{subtitle_result.get('message', '')}；"
                f"未下载到字幕的链接已回退到视频下载流程：{fallback_result.get('message', '')}"
            ),
            "results": subtitle_result.get("results", []),
            "fallback": fallback_result
        }
    else:
        result = subtitle_result

Technical Analysis

An invocation with onlysubtitle=true expresses a restricted operation: retrieve subtitles without downloading the media. If subtitle retrieval fails, the script silently changes onlysubtitle to false and calls download_videos.

The fallback retains the remaining caller parameters. Because the transcribe parameter defaults to true in download_videos, this can cause the program to download the complete video, retrieve or load a Faster Whisper model, invoke FFmpeg, extract audio, and perform CPU/GPU-intensive transcription. No separate option or confirmation authorizes this broader workflow.

This violates least-privilege and fa ...[truncated 1294 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the implicit fallback and return a clear subtitle-download failure by default.
• If fallback behavior is needed, introduce an explicit fallback_to_video parameter that defaults to false.
• Require affirmative user confirmation before changing from subtitle-only mode to full media download.
• Keep transcribe disabled during fallback unless independently and explicitly enabled.
• Apply configurable limits for maximum download size, duration, output storage, execution time, and model size.
• Preflight media metadata and show the estimated download size and processing requirements before proceeding.
• Report fallback actions as distinct operations rather than combining them into subtitle-only success.
• Add tests verifying that onlysubtitle=true never downloads video or initializes transcription unless explicit fallback authorization is present.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (49)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 177)May include surrounding context.

ut":"./downloads","overwrite_subtitle":false}'

text

### Download video with Cookie:
```bash
python scripts/video_parser.py '{"urls":["https://www.youtube.com/watch?v=VIDEO_ID"],"output":"./downloads","cookie":"sid=xxx; token=yyy"}'

Download video with cookies from browser:

bash

python scripts/video_parser.py '{"urls":["https://www.youtube.com/watch?v=VIDEO_ID"],"output":"./downloads","cookiesfrombrowser":"chrome"}'

Download video with cookie file:

bash

python scripts/video_parser.py '{"urls":["https://www.youtube.com/watch?v=VIDEO_ID"],"output":"./downloads","cookiefile":"/path/to/cookies.txt"}'

Only download subtitles:

bash

python scripts/video_parser.py '{"urls":["https://www.youtube.com/watch?v=VIDEO_ID"],"output":"./downloads","onlysubtitle":true,"cookiefile":"/path/to/cookies.txt"}'

cookiefile usage:

• Install the Get cookies.txt LOCALLY Chrome extension first.
  URL: <https://chromewebstore.google.com/detail/get-cookiestxt-locally/

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 32)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 91)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 144)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 145)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 252)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 541)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 651)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 692)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 727)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 755)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 879)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 880)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 891)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 930)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 931)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 949)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 950)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 953)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 976)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 1027)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 1110)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 1328)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 1330)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/supportedsites.md (reported line 1360)May include surrounding context.

md

- **9now.com.au**
 - **abc.net.au**
 - **abc.net.au:iview**
 - **abc.net.au:​iview:showseries**
 - **abcnews**
 - **abcnews:video**
 - **abcotvs**: ABC Owned Television Stations

Static analysis

No suspicious patterns detected.