youtube-downloader
Pass
Audited by Gen Agent Trust Hub on Aug 30, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/download_video.pyautomatically installs theyt-dlppackage from PyPI usingpip installif it is not detected on the system. - [COMMAND_EXECUTION]: The skill uses
subprocess.runto executeyt-dlpcommands for video analysis and downloading. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted metadata from YouTube videos, which represents a potential surface for indirect prompt injection.
- Ingestion points: The
get_video_infofunction inscripts/download_video.pyretrieves video metadata (such as titles and uploader information) from external YouTube URLs. - Boundary markers: Absent.
- Capability inventory: The skill can write files to the local file system and execute subprocesses via the
yt-dlputility. - Sanitization: Absent; the script prints retrieved video metadata directly to the standard output without filtering.
Audit Metadata