The Agent Skills Directory

[COMMAND_EXECUTION]: The skill explicitly allows and encourages the use of an 'escape hatch' where any arguments provided after the URL are passed verbatim to the yt-dlp CLI. The yt-dlp tool supports dangerous flags such as --exec, which executes arbitrary shell commands upon completion of a download, and --postprocessor-args. This design allows an attacker to achieve command execution by tricking the agent into passing malicious flags.
[COMMAND_EXECUTION]: The skill includes a -d parameter that allows the agent to specify an arbitrary destination directory. The script executes mkdir -p on this path and directs the downloader to save files there. This capability could be abused to write files into sensitive locations such as SSH configuration directories (~/.ssh), shell startup profiles (~/.bashrc), or other system paths to achieve persistence or escalate privileges.
[DATA_EXFILTRATION]: The skill's documentation and recipes suggest using the --cookies-from-browser flag. This feature allows the tool to access and extract sensitive session cookies from the user's local web browsers (e.g., Firefox, Chrome, Safari). If an agent is induced to use this flag, it could lead to the unauthorized exposure of the user's authenticated web sessions.
[INDIRECT_PROMPT_INJECTION]: The skill is vulnerable to indirect prompt injection because it ingests untrusted URL strings and passthrough arguments from the session context and interpolates them into a shell command without sufficient sanitization.
Ingestion points: The $ARGUMENTS variable in SKILL.md and the shifted $@ array in scripts/download-media.sh.
Boundary markers: No delimiters or safety instructions are used to prevent the agent from interpreting malicious flags embedded in a user's prompt or a processed webpage.
Capability inventory: The yt-dlp tool has extensive capabilities including network access, file system writes, and arbitrary command execution.
Sanitization: While the script validates that the primary input looks like a URL, it performs no sanitization or filtering on the passthrough arguments, allowing the injection of dangerous CLI flags.

download-media