Download Video

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill is a straightforward video downloader, but it gives agents under-scoped instructions to install software and use browser login cookies.

Install only if you are comfortable with an agent downloading media to your Videos folder and potentially installing yt-dlp. Do not let it use browser cookies unless you explicitly intend to access authenticated content, because that can expose active login sessions from your Chrome profile.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:16
• Finding: Unpinned Third-Party Dependency Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 16-22 **Vulnerability Type**: Unpinned and unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```text **yt-dlp** must be installed: ``` yt-dlp --version # Install if missing pip install yt-dlp # cross-platform winget install yt-dlp # Windows brew install yt-dlp # macOS sudo apt install yt-dlp # Debian/Ubuntu ``` ``` ### Technical Analysis The Skill instructs the Agent to install `yt-dlp` from external package repositories without pinning a reviewed version or requiring package signature, checksum, or source verification. The effective installed content can therefore change after the Skill has been audited. The `pip install yt-dlp` command resolves mutable content from the configured Python package index and does not use a version constraint or hash. The `winget`, Homebrew, and APT alternatives similarly do not identify an approved version. In addition, `sudo apt install yt-dlp` may run package installation operations with elevated privileges. No evidence shows that the named `yt-dlp` package is currently malicious. The risk arises from unsafe dependency acquisition: compromise of an upstream release, package repository, mirror, local package-manager configuration, or dependency chain could cause attacker-controlled code to be installed or executed. ### Attack Path 1. A user asks the Agent to download a supported video. 2. The Agent checks for `yt-dlp` and determines that it is unavailable. 3. Following the Skill, the Agent invokes one of the unpinned package installation commands. 4. A compromised package release, repository, mirror, configured package source, or transitive dependency supplies attacker-controlled content. 5. Malicious installation or runtime code executes under the account that invoked the package manager. 6. If installation is performed through the documented `su ...[truncated 817 chars]
• Remediation: ## Remediation Suggestions - Do not install dependencies automatically. Ask for explicit user confirmation before changing the environment. - Pin `yt-dlp` to a reviewed version rather than resolving the latest available release. - For Python installation, use an approved lock file or a pinned requirement with cryptographic hashes, such as `--require-hashes`. - Restrict installation to explicitly trusted package indexes and repositories. - Verify available publisher signatures, repository metadata, checksums, or release attestations before installation. - Prefer an isolated virtual environment or sandbox instead of installing into the global Python or system environment. - Avoid privileged installation where a user-scoped installation is sufficient. Never invoke `sudo` automatically. - Document a vetted installation procedure separately for each supported platform. - Require separate, explicit user consent before accessing browser cookies, and limit cookie access to cases where authenticated content is genuinely required.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

mat mp3` |
| Specific resolution | `-f "bestvideo[height<=720]+bestaudio"` |
| Subtitles | `--write-subs --sub-langs zh-Hans,en` |
| Playlist (all videos) | just pass the playlist URL |
| Limit speed | `--rate-limit 2M` |

## Common Mistakes

- **"ffmpeg not found"** — merge of best video+audio fails. Install ffmpeg or use `-f best` (single stream).
- **Bilibili login-required content** — add cookies with `--cookies-from-browser chrome`.
- **Videos folder missing** — create it first.

## Workflow

1. **URL given** → download directly
2. **Title given** → use `ytsearch1:` or `bilisearch1:` prefix
3. **yt-dlp missing** → install, then retry
4. **Error** → read error message, check Common Mistakes above

• Confidence: 95% confidence
• Finding: The recommendation to use '--cookies-from-browser chrome' instructs the agent to access browser-stored authentication cookies, which are sensitive credentials. In an agent setting, this can enable collection and use of session tokens from the user's browser profile, creating a real risk of credential exposure, unauthorized account access, or overbroad access to unrelated browser data.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The manifest description says to use the skill whenever the user wants to download a YouTube or Bilibili video by URL or title, but it does not define clearer boundaries, exclusions, or negative examples. That broad phrasing could cause unintended invocation for casual discussion of videos or exploratory questions rather than explicit download requests.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs the agent to save downloaded content directly into the user's local Videos folder without requiring an explicit confirmation step or warning about local file writes. In an agent context, automatic file creation on the local system can violate user expectations, create unwanted persistence, and increase risk if the skill is triggered accidentally or by ambiguous prompts.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

pip install yt-dlp        # cross-platform
winget install yt-dlp      # Windows
brew install yt-dlp        # macOS
sudo apt install yt-dlp    # Debian/Ubuntu
```

**ffmpeg** is recommended for merging video+audio streams.

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.