Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Yt Dlp Downloader

Download videos from YouTube, Bilibili, Twitter, and thousands of other sites using yt-dlp. Use when the user provides a video URL and wants to download it, extract audio (MP3), download subtitles, or select video quality. Triggers on phrases like "下载视频", "download video", "yt-dlp", "YouTube", "B站", "抖音", "提取音频", "extract audio".

MIT-0 · Free to use, modify, and redistribute. No attribution required.
8 · 5.8k · 39 current installs · 41 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The skill's name and description align with the runtime instructions (building yt-dlp commands for downloads, audio extraction, subtitles, quality selection). However the metadata omits expected requirements: the SKILL.md clearly requires yt-dlp and ffmpeg (and access to browser cookies for YouTube), yet no required binaries or config paths are declared. The source/homepage is unknown, which reduces traceability.
!
Instruction Scope
SKILL.md instructs the agent to construct and execute shell commands (yt-dlp, ffmpeg, pip/brew) and explicitly to use --cookies-from-browser (chrome). That implies reading browser cookie stores and writing downloaded files to user directories. The instructions also include an explicit directive to execute the download using a Shell tool with required_permissions: ["all","network"], which grants broad file and network access. Reading browser cookies and running arbitrary shell installs/commands are outside a minimal 'download helper' scope unless the user explicitly consents and the skill declares the access.
Install Mechanism
This is an instruction-only skill so nothing is written during install (low install-time risk). The guide recommends runtime package installs (pip install yt-dlp, brew install ffmpeg). That means the agent (or user) may be asked to install third-party packages at runtime — expected for this functionality, but installation commands modify system state and should be run intentionally by the user, not silently by an agent.
!
Credentials
No environment variables or credentials are declared, which is good. But the instructions require access to browser cookies (sensitive data) and file system write locations (~/Downloads/yt-dlp) without declaring required config paths or prompting for explicit consent. The SKILL.md's recommendation to use cookies-from-browser could expose many unrelated site cookies; this is disproportionate unless clearly authorized by the user.
Persistence & Privilege
The skill does not request 'always: true' and is user-invocable (normal). However the instructions call for shell execution with broad permissions and network access; if the agent invokes this skill autonomously, that increases the potential blast radius. This is not an automatic disqualifier, but you should ensure the agent prompts before running installs, accessing cookies, or writing files.
What to consider before installing
This skill appears to do what it claims (yt-dlp downloads) but the runtime instructions request sensitive actions that are not reflected in the metadata: it tells the agent to run shell commands, install packages, write files, and (for YouTube) extract browser cookies. Before installing or enabling the skill: 1) Only allow it to run when you explicitly approve each download/install; do not grant blanket 'all' permissions. 2) Prefer installing yt-dlp and ffmpeg yourself and decline automatic installs. 3) Be cautious about using --cookies-from-browser: it can expose browser cookies for many sites; if you don't want that, avoid or refuse that option. 4) Ask the publisher to declare required binaries/config paths in metadata and to remove the instruction that requests blanket required_permissions; if the author cannot explain why cookie access and wide shell permissions are needed, treat the skill as risky. 5) Consider running downloads manually if you are unsure about the skill or the unknown source.

Like a lobster shell, security has layers — review code before you run it.

Current versionv0.1.0
Download zip
latestvk971rcvxqr0kz2ncym9ss74esx801ncj

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

yt-dlp Video Downloader

Download videos from thousands of websites using yt-dlp.

Prerequisites

Before downloading, verify dependencies are installed:

# Check yt-dlp
which yt-dlp || echo "yt-dlp not installed. Install with: pip install yt-dlp"

# Check ffmpeg (required for audio extraction and format merging)
which ffmpeg || echo "ffmpeg not installed. Install with: brew install ffmpeg"

If not installed, install them first:

pip install yt-dlp
brew install ffmpeg  # macOS

Quick Start

Basic Download (Best Quality)

yt-dlp -P "~/Downloads/yt-dlp" "VIDEO_URL"

YouTube Download (Recommended - with cookies)

YouTube often blocks direct downloads with 403 errors. Always use browser cookies for YouTube:

yt-dlp -P "~/Downloads/yt-dlp" --cookies-from-browser chrome "YOUTUBE_URL"

Supported browsers: chrome, firefox, safari, edge, brave, opera

Download with Custom Output Path

yt-dlp -P "/path/to/save" -o "%(title)s.%(ext)s" "VIDEO_URL"

Common Tasks

1. Download Video (Default - Best Quality)

yt-dlp -P "~/Downloads/yt-dlp" "VIDEO_URL"

2. Extract Audio Only (MP3)

yt-dlp -P "~/Downloads/yt-dlp" -x --audio-format mp3 "VIDEO_URL"

3. Download with Subtitles

yt-dlp -P "~/Downloads/yt-dlp" --write-subs --sub-langs all "VIDEO_URL"

4. Download Specific Quality

720p:

yt-dlp -P "~/Downloads/yt-dlp" -f "bestvideo[height<=720]+bestaudio/best[height<=720]" "VIDEO_URL"

1080p:

yt-dlp -P "~/Downloads/yt-dlp" -f "bestvideo[height<=1080]+bestaudio/best[height<=1080]" "VIDEO_URL"

Best available:

yt-dlp -P "~/Downloads/yt-dlp" -f "bestvideo+bestaudio/best" "VIDEO_URL"

5. List Available Formats (Before Download)

yt-dlp -F "VIDEO_URL"

Then download specific format by ID:

yt-dlp -P "~/Downloads/yt-dlp" -f FORMAT_ID "VIDEO_URL"

6. Download Playlist

# Download entire playlist
yt-dlp -P "~/Downloads/yt-dlp" -o "%(playlist)s/%(playlist_index)s - %(title)s.%(ext)s" "PLAYLIST_URL"

# Download specific range (e.g., items 1-5)
yt-dlp -P "~/Downloads/yt-dlp" -I 1:5 "PLAYLIST_URL"

7. Download with Thumbnail

yt-dlp -P "~/Downloads/yt-dlp" --write-thumbnail "VIDEO_URL"

Workflow

When user provides a video URL:

  1. Identify the platform:

    • YouTube/YouTube Music → Always use --cookies-from-browser chrome
    • Other sites → Try without cookies first
  2. Ask what they want (if not specified):

    • Just download the video?
    • Extract audio only?
    • Need subtitles?
    • Specific quality?
  3. Construct the command based on requirements

  4. Execute the download using Shell tool with required_permissions: ["all", "network"]

  5. Handle errors:

    • 403 Forbidden → Retry with --cookies-from-browser
    • Connection issues → yt-dlp auto-resumes, just retry
    • Format unavailable → Use -F to list formats, then select
  6. Report the result - file location and any errors

Example Interaction

User: "帮我下载这个视频 https://www.youtube.com/watch?v=xxx"

Response:

# YouTube - use cookies to avoid 403 errors
yt-dlp -P "~/Downloads/yt-dlp" --cookies-from-browser chrome "https://www.youtube.com/watch?v=xxx"

User: "下载这个视频的音频 https://www.bilibili.com/video/xxx"

Response:

# Bilibili - extracting audio as MP3
yt-dlp -P "~/Downloads/yt-dlp" -x --audio-format mp3 "https://www.bilibili.com/video/xxx"

User: "下载这个 Twitter 视频 https://twitter.com/xxx/status/123"

Response:

# Twitter/X - direct download usually works
yt-dlp -P "~/Downloads/yt-dlp" "https://twitter.com/xxx/status/123"

Supported Sites

yt-dlp supports thousands of sites including:

  • YouTube, YouTube Music
  • Bilibili (B站)
  • Twitter/X
  • TikTok, Douyin (抖音)
  • Vimeo
  • Twitch
  • And many more...

Full list: https://github.com/yt-dlp/yt-dlp/blob/master/supportedsites.md

Troubleshooting

Common Errors and Solutions

ErrorCauseSolution
HTTP 403 ForbiddenYouTube blocks unauthenticated requestsUse --cookies-from-browser chrome
Video unavailableGeo-restricted or privateUse cookies or VPN
Download interruptedNetwork issuesRetry - yt-dlp auto-resumes
Format not availableRequested format doesn't existUse -F to list formats

Error: "yt-dlp: command not found"

pip install yt-dlp

Error: "ffmpeg not found" (for audio extraction)

brew install ffmpeg  # macOS

Error: HTTP 403 Forbidden (YouTube)

This is the most common YouTube error. Always use cookies for YouTube:

# Recommended approach for YouTube
yt-dlp -P "~/Downloads/yt-dlp" --cookies-from-browser chrome "YOUTUBE_URL"

Supported browsers: chrome, firefox, safari, edge, brave, opera

Error: Video unavailable or geo-restricted

# Try with cookies from browser
yt-dlp --cookies-from-browser chrome "VIDEO_URL"

# Or use a specific format
yt-dlp -F "VIDEO_URL"  # List formats first
yt-dlp -f FORMAT_ID "VIDEO_URL"

Error: Download keeps failing

# Update yt-dlp to latest version
pip install -U yt-dlp

# Force IPv4 (sometimes helps with connection issues)
yt-dlp -4 "VIDEO_URL"

Best Practices

  1. YouTube downloads: Always use --cookies-from-browser chrome
  2. Large files: yt-dlp auto-resumes, just retry if interrupted
  3. Keep yt-dlp updated: pip install -U yt-dlp
  4. Check formats first: Use -F before downloading if unsure

Files

1 total
Select a file
Select a file to preview.

Comments

Loading comments…