YouTube Media Downloader

PassAudited by ClawScan on May 10, 2026.

Overview

This skill appears to do its advertised YouTube downloading job, but it will install and run external downloader tools from GitHub if they are not already present.

Before installing, be comfortable with the scripts downloading executable yt-dlp and ffmpeg binaries into your home directory if missing. Consider preinstalling trusted versions yourself, use download limits for playlists, choose an output folder intentionally, and make sure your downloads comply with YouTube terms and copyright rules.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If an upstream release, download path, or local environment is compromised, the downloaded tools would run with the user's account permissions.

Why it was flagged

On first run, missing dependencies are downloaded from latest GitHub release URLs and made usable locally without pinned versions or checksum verification. This is consistent with the downloader purpose and disclosed in SKILL.md, but the exact code fetched at runtime is outside the reviewed artifacts.

Skill content

curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o "$HOME/yt-dlp"
chmod +x "$HOME/yt-dlp"
...
curl -L https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-linux64-gpl.tar.xz -o ffmpeg.tar.xz
tar -xf ffmpeg.tar.xz --strip-components=1

Recommendation

Prefer installing yt-dlp and ffmpeg yourself from trusted, pinned sources, or ask the skill maintainer to pin versions and verify checksums before execution.

Note

ASI08: Cascading Failures

What this means

Downloading a large playlist could consume significant bandwidth and disk space.

Why it was flagged

Batch downloads have no maximum by default unless the user supplies a limit, so a large playlist can trigger many file downloads. The script does provide range and max-download options, making this a purpose-aligned operational note rather than a concern.

Skill content

MAX_DOWNLOADS=""
...
if [ -n "$MAX_DOWNLOADS" ]; then
    YT_ARGS+=("--max-downloads" "$MAX_DOWNLOADS")
fi
...
$YT_DLP "${YT_ARGS[@]}" "$INPUT"

Recommendation

Use the output-directory, start/end range, and max-download options for large playlists, and confirm there is enough disk space before running.