youtube-downloader

Pass

Audited by Gen Agent Trust Hub on Aug 30, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/download_video.py automatically installs the yt-dlp package from PyPI using pip install if it is not detected on the system.
  • [COMMAND_EXECUTION]: The skill uses subprocess.run to execute yt-dlp commands for video analysis and downloading.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from YouTube videos, which represents a potential surface for indirect prompt injection.
  • Ingestion points: The get_video_info function in scripts/download_video.py retrieves video metadata (such as titles and uploader information) from external YouTube URLs.
  • Boundary markers: Absent.
  • Capability inventory: The skill can write files to the local file system and execute subprocesses via the yt-dlp utility.
  • Sanitization: Absent; the script prints retrieved video metadata directly to the standard output without filtering.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 30, 2026, 02:56 PM
Security Audit — agent-trust-hub — youtube-downloader