yt-dlp-downloader
Warn
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill automatically installs external software dependencies at runtime. It uses
pip installfor theyt-dlpPython package and system package managers (apt,brew, orchoco) to install theffmpegbinary if they are not already present. - [COMMAND_EXECUTION]: The script
scripts/main.pyuses thesubprocess.runmodule to execute system-level commands for checking dependencies, performing installations, and running the video download process. High-privilege commands likeapt installare executed depending on the host operating system. - [COMMAND_EXECUTION]: User-provided input (the video URL) is passed as an argument to the
yt-dlpcommand-line tool. Although the skill uses list-based subprocess calls to prevent basic shell injection, passing untrusted input to complex CLI tools remains a potential vector for argument injection or exploiting vulnerabilities in the tool itself.
Audit Metadata