video-downloader
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill recommends installing the
yt-dlppackage using standard package managers likepiporbrew. It also provides a command (yt-dlp -U) for the tool to update itself from its own remote sources. - [COMMAND_EXECUTION]: The skill's primary function is to facilitate the execution of
yt-dlpcommands within the agent's environment to download media, extract audio, and manage files. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data by accepting user-provided URLs which
yt-dlpthen accesses to fetch video content and metadata. - Ingestion points: The skill accepts arbitrary URLs and video IDs in
SKILL.mdas input for command-line operations. - Boundary markers: There are no explicit instructions or delimiters provided to prevent the agent from being influenced by potentially malicious instructions embedded in video titles, descriptions, or other metadata fetched by the tool.
- Capability inventory: The skill utilizes
yt-dlpwhich performs network operations to external domains and writes files to the local file system (e.g.,~/Videos/). - Sanitization: The skill does not specify any sanitization, validation, or filtering for the input URLs before they are passed to the shell.
Audit Metadata