video-download-assist

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:43 AM UTC
• Version: 1.0.0

Overview

This appears to be a real video-downloader skill, but it needs Review because it recommends sensitive browser-cookie access and unverified privileged installation steps.

Install only if you are comfortable with a skill that downloads remote videos to local storage. Prefer a package-manager or isolated environment for yt-dlp, avoid the documented sudo curl latest install path, and do not use browser-cookie options unless you understand they expose sensitive login sessions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned and Unverified Third-Party Executable Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:35-50; duplicated in README.md:5-16
Vulnerability Type: Unsafe third-party dependency installation
Risk Level: Medium
Classification: T08: Insecure Dependencies

Vulnerable Code

From SKILL.md:35-50:

bash

### 方法 2: 直接下载最新版

```bash
# 下载二进制文件
sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

# 验证安装
yt-dlp --version

方法 3: pip 安装

bash

pip install yt-dlp

text

The same unsafe installation patterns appear in `README.md:5-16`:

```bash
使用前需要安装 `yt-dlp`:

```bash
# 方法 1: 系统包 (推荐)
sudo apt-get install yt-dlp

# 方法 2: pip
pip install yt-dlp

# 方法 3: 直接下载二进制
sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

Technical Analysis

The installation documentation retrieves the mutable latest yt-dlp executable and places it directly in the system-wide /usr/local/bin directory. It does not pin a reviewed release, verify a cryptographic checksum, or validate a release signature. The alternative pip install yt-dlp command is also unpinned and does not require hash verification.

Although the URL references the official yt-dlp GitHub repository and there is no evidence of intentional malicious behavior, the installation process relies entirely on the continuing integrity of the upstream release and package-distribution infrastructure. A compromised upstream account, release asset, package registry, or distribution channel could cause users to install attacker-controlled code.

The use of sudo increases the sensitivity of the installation operation because the downloaded file is written into a privileged, system-wide executable directory. The downloaded binary is not executed by the curl command itself, but it will exe ...[truncated 1831 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to a specific reviewed release rather than using the mutable latest endpoint:

   bash

   YTDLP_VERSION="2026.09.01"
   curl -fL \
     "https://github.com/yt-dlp/yt-dlp/releases/download/${YTDLP_VERSION}/yt-dlp" \
     -o ./yt-dlp
   

2. Publish the expected SHA-256 digest in the documentation and verify it before installation:

   bash

   echo "<reviewed-sha256>  yt-dlp" | sha256sum --check -
   

3. Abort installation if download or integrity verification fails. Use options such as curl -fL and perform verification before moving the file into an executable directory.

4. Download and verify the artifact as an unprivileged user. Use elevated privileges only for the final move into /usr/local/bin:

   bash

   sudo install -o root -g root -m 0755 ./yt-dlp /usr/local/bin/yt-dlp
   

5. For Python installation, pin the exact package version and use hashes in a reviewed requirements file:

   text

   yt-dlp==<reviewed-version> \
       --hash=sha256:<reviewed-package-hash>
   

   Install it with:

   bash

   python -m pip install --require-hashes -r requirements.txt
   

6. Prefer an isolated virtual environment or other restricted execution environment instead of installing the dependency globally.

7. Apply the corrected instructions consistently to both SKILL.md and README.md so users are not directed to the unsafe installation path by either document.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (15)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The trigger list is excessively broad, including generic phrases like '下载这个' and any matching video domains, which can cause the skill to activate on ordinary conversation or pasted links without clear user intent. Because the skill performs a side effect by downloading and saving files locally, unintended activation can lead to unapproved network access, disk writes, and possible downloading of unsafe or inappropriate content.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 89% confidence

Finding

The instruction to use '--cookies-from-browser chrome' directs extraction of authentication cookies from a local browser profile. Even though presented as a convenience for downloading login-protected videos, browser cookies are sensitive credentials; normalizing their extraction increases the risk of account compromise, overcollection of unrelated session data, and misuse in agentic environments.

Content

Scanner excerpt · SKILL.md (reported line 186)May include surrounding context.

��低画质要求 yt-dlp -f "best[height<=720]"

或使用默认格式

yt-dlp

text

### Q: 下载速度慢

**解决：**
```bash
# 限制并发连接数
yt-dlp --concurrent-fragments 4 <URL>

# 使用代理 (如果需要)
yt-dlp --proxy http://proxy:port <URL>

Q: 需要登录才能下载

解决： 从浏览器导出 cookies

bash

# 从 Chrome 导出 cookies
yt-dlp --cookies-from-browser chrome <URL>

# 或使用 cookies 文件
yt-dlp --cookies cookies.txt <URL>

Q: 视频文件名乱码

解决： 脚本已处理中文编码，确保系统 locale 支持 UTF-8

bash

# 检查 locale
locale

# 如需要，设置 UTF-8
export LANG=en_US.UTF-8

📁 文件结构

text

video-downloader/
├── SKILL.md              # 技能说明文件
├── scripts/
│   └── download_video.py # 下载脚本 (可选，直接用 yt-dlp 更简单)
├── references/
│   └── README.md         # 详细安装和使用指南
└── REA

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 91% confidence

Finding

The README instructs users to run installation commands with sudo, which encourages privileged execution without discussing trust, package provenance, or least-privilege alternatives. In a skill context, normalizing root-level installation raises the risk of system-wide damage if users paste commands blindly or install from an untrusted environment.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

bash

# 方法 1: 系统包 (推荐)
sudo apt-get install yt-dlp

# 方法 2: pip
pip install yt-dlp

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This instruction downloads a binary via curl and writes it directly into /usr/local/bin using sudo, creating a privileged supply-chain risk if the URL, transport, release artifact, or hosting account is compromised. Piping externally retrieved software into a system path without checksum or signature verification is especially risky because it can lead to full system compromise.

Content

Scanner excerpt · README.md (reported line 15)May include surrounding context.

pip install yt-dlp

方法 3: 直接下载二进制

sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp sudo chmod a+rx /usr/local/bin/yt-dlp

text

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

Using sudo chmod on a binary in a system directory is a privileged modification step that reinforces a root-required installation flow. While chmod itself is not inherently malicious, in this context it completes a direct manual system-wide install path that can make an unverified binary executable for all users.

Content

Scanner excerpt · README.md (reported line 16)May include surrounding context.

方法 3: 直接下载二进制

sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp sudo chmod a+rx /usr/local/bin/yt-dlp

text

## 使用方法

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that videos will be automatically downloaded into a local workspace directory, but it does not warn about implicit filesystem writes, disk consumption, or retention of potentially large media files. In an agent skill context, silent writes can surprise users, fill storage, and persist untrusted content locally without explicit consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description emphasizes automatic downloading but does not prominently warn that it writes files to local storage by default. Users or calling agents may invoke it without understanding that it creates persistent local artifacts, which increases the risk of privacy issues, storage abuse, and accidental retention of copyrighted or sensitive material.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install yt-dlp

# macOS (Homebrew)
brew install yt-dlp

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

bash

# Ubuntu/Debian
sudo apt-get install yt-dlp

# macOS (Homebrew)
brew install yt-dlp

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The skill instructs users to pipe a downloaded binary from the internet into a privileged system location using sudo, without any checksum or signature verification. This creates a software supply-chain risk: if the download source, transport, or release asset is compromised, a malicious executable could be installed system-wide with elevated trust.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

bash

# 下载二进制文件
sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod a+rx /usr/local/bin/yt-dlp

# 验证安装

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/download_video.py (reported line 46)May include surrounding context.

python

]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=600)
        if result.returncode == 0:
            # Extract the file path from output
            file_path = result.stdout.strip().split('\n')[-1]

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file mixes an English title with Chinese usage instructions such as 安装依赖 and 使用方法, which effectively forces a specific language for core user guidance. Under the language/locale policy rule, this is a violation unless the skill offers user choice or clearly documents a justified locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This code creates a download directory and saves both the media file and an info JSON file, which affects user storage and persists metadata locally. Although the module docstring says it is a downloader, there is no explicit user-facing disclosure in code output about where files and metadata will be written before the operation occurs.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The script invokes an external program via subprocess to perform the download, which is a safety-relevant operation under the rule. While running yt-dlp is aligned with the script's purpose, there is no explicit user-facing notice in this file that an external executable will be launched.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The function name, docstring, and module header state that Douyin/TikTok downloads use "Douyin_TikTok_Download_API," which implies a distinct implementation path. In reality, the function immediately delegates to download_with_ytdlp, so the documentation actively misstates how the code operates.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.