Universal Video Downloader

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:03 AM UTC
• Version: 1.0.0

Overview

The skill does what it says, but its browser-download mode has under-disclosed security exposure because it uses authenticated browser automation and disables Chromium sandboxing for remote video pages.

Review before installing. Use this only in an isolated environment or disposable browser profile, avoid running it as an administrator/root user, and be aware that browser mode may use logged-in cookies while visiting third-party video pages. Prefer pinned dependencies and keep Chromium/DrissionPage updated.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:32

Finding

Unpinned Third-Party Dependencies Permit Supply-Chain Substitution

Content

View full analysis

Remediation

View remediation

requests== DrissionPage== ``` 2. Generate and verify cryptographic hashes, then install with: ```bash python -m pip install --require-hashes -r requirements.txt ``` 3. Maintain a lock file through a dependency-management tool and update it only after reviewing release changes and vulnerability advisories. 4. Specify trusted package-index policy rather than silently accepting arbitrary user-configured indexes. 5. Recommend installation inside a dedicated virtual environment or disposable container under an unprivileged account. 6. Add automated dependency vulnerability and provenance checks to the release process. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/video_downloader.py:143

Finding

Chromium Sandbox Disabled While Processing Untrusted Web Pages

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documents capabilities that imply network access, filesystem writes, and shell execution via Python scripts and external tooling, but it declares no explicit permission or allowed-tools scope. This creates a trust and containment gap: an agent may invoke the skill without clear sandboxing expectations, increasing the chance of unintended external access or local file modification.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation description is broad enough to match generic requests to download videos across many platforms, which can cause over-triggering in unrelated contexts. In practice, this can route users into a workflow that performs network access, file downloads, and browser automation without sufficiently specific user intent or platform constraints.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill notes that browser mode uses browser cookies for authenticated access, but it does not clearly warn that search/browser automation may send authenticated session data and browsing context to third-party platforms. This is dangerous because users may unknowingly expose logged-in account context, personalized data, or privileged access when the tool opens anti-crawl sites through a real browser session.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This file contains natural-language strings that assume Chinese as the operating language, such as the class docstring at L010, while the tool otherwise appears to be a general-purpose downloader. Under the policy, forcing a specific language without user opt-in is a locale/language policy violation.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 19)May include surrounding context.

python

def _check_yt_dlp(self):
        try:
            subprocess.run(['yt-dlp', '--version'], capture_output=True, check=True)
            return True
        except:
            return False

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 68)May include surrounding context.

python

try:
            # 获取视频信息
            cmd = ['yt-dlp', '--dump-json', '--no-download', '--quiet', url]
            result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
            
            if result.returncode != 0 or not result.stdout:
                print(f"    Cannot get video info, trying direct download...")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/video_downloader.py (reported line 95)May include surrounding context.

python

url
            ]
            
            download_result = subprocess.run(download_cmd, capture_output=True, timeout=180)
            
            if download_result.returncode == 0:
                downloaded_files = [f for f in os.listdir(self.save_path)

Static analysis

No suspicious patterns detected.