skills/eyadsibai/ltk/video-downloader/Gen Agent Trust Hub

video-downloader

Pass

Audited by Gen Agent Trust Hub on Sep 23, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill recommends installing the yt-dlp package using standard package managers like pip or brew. It also provides a command (yt-dlp -U) for the tool to update itself from its own remote sources.
  • [COMMAND_EXECUTION]: The skill's primary function is to facilitate the execution of yt-dlp commands within the agent's environment to download media, extract audio, and manage files.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by accepting user-provided URLs which yt-dlp then accesses to fetch video content and metadata.
  • Ingestion points: The skill accepts arbitrary URLs and video IDs in SKILL.md as input for command-line operations.
  • Boundary markers: There are no explicit instructions or delimiters provided to prevent the agent from being influenced by potentially malicious instructions embedded in video titles, descriptions, or other metadata fetched by the tool.
  • Capability inventory: The skill utilizes yt-dlp which performs network operations to external domains and writes files to the local file system (e.g., ~/Videos/).
  • Sanitization: The skill does not specify any sanitization, validation, or filtering for the input URLs before they are passed to the shell.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 23, 2026, 06:08 PM