The Agent Skills Directory

[COMMAND_EXECUTION]: The skill executes external binaries yt-dlp, ffmpeg, and ffprobe via subprocess.run to handle video downloading, merging, and validation. Commands are constructed as lists and do not use a shell context, which prevents common command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: Downloads media content and metadata from various social media domains (YouTube, Bilibili, TikTok, etc.). It optionally interacts with a third-party resolution API (tikwm.com) and a user-provided WeChat resolution service. These operations are standard for the skill's primary purpose.
[INDIRECT_PROMPT_INJECTION]: The skill processes external web content like page titles and video descriptions to generate output filenames. A sanitization function (clean_filename) is used to strip dangerous characters (e.g., directory traversal or shell control characters) from these strings before file system operations.
[EXTERNAL_DOWNLOADS]: Disables SSL certificate verification globally within the script (ssl._create_unverified_context) to facilitate downloads from certain CDNs that may have certificate issues. While this facilitates the tool's function, it is noted as a decrease in transport security.
[COMMAND_EXECUTION]: Automated scanners identified the download-then-process pattern as potential remote code execution. However, manual analysis confirms these are media validation steps using standard parsers (ffprobe) on downloaded content, which is legitimate behavior for a video downloader.

video-download