yt-dlp-downloader

Warn

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill automatically installs external software dependencies at runtime. It uses pip install for the yt-dlp Python package and system package managers (apt, brew, or choco) to install the ffmpeg binary if they are not already present.
  • [COMMAND_EXECUTION]: The script scripts/main.py uses the subprocess.run module to execute system-level commands for checking dependencies, performing installations, and running the video download process. High-privilege commands like apt install are executed depending on the host operating system.
  • [COMMAND_EXECUTION]: User-provided input (the video URL) is passed as an argument to the yt-dlp command-line tool. Although the skill uses list-based subprocess calls to prevent basic shell injection, passing untrusted input to complex CLI tools remains a potential vector for argument injection or exploiting vulnerabilities in the tool itself.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Jun 27, 2026, 04:16 AM