video-download
Pass
Audited by Gen Agent Trust Hub on Nov 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill specifies shell command templates for the
yt-dlputility. This is the intended primary functionality for downloading and processing media files. - [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided URLs which are interpolated into shell commands.
- Ingestion points: The
URLplaceholder withinyt-dlpcommand blocks inSKILL.md. - Boundary markers: All provided command examples wrap the user input in double quotes (e.g.,
yt-dlp "URL"), which is a standard security measure. - Capability inventory: The skill triggers the execution of
yt-dlpto fetch and process remote content. - Sanitization: The use of shell quoting serves as basic sanitization against common command injection attempts within the URL string.
Audit Metadata