claude-video-download
Pass
Audited by Gen Agent Trust Hub on Sep 20, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides numerous Bash command templates to interface with the yt-dlp utility for video and audio processing, which is the primary intended function of the skill.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted external content in the form of video URLs.\n
- Ingestion points: User-supplied 'URL' and 'PLAYLIST_URL' variables are interpolated into Bash commands defined in SKILL.md.\n
- Boundary markers: Command templates consistently utilize double quotes (e.g., "URL") to wrap user input, providing a defensive boundary against shell command injection.\n
- Capability inventory: The skill uses the Bash tool to execute external CLI commands.\n
- Sanitization: The skill relies on standard shell quoting within its instruction set to sanitize input for the command-line interface.
Audit Metadata