video-download

Pass

Audited by Gen Agent Trust Hub on Nov 1, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill specifies shell command templates for the yt-dlp utility. This is the intended primary functionality for downloading and processing media files.
  • [INDIRECT_PROMPT_INJECTION]: The skill accepts user-provided URLs which are interpolated into shell commands.
  • Ingestion points: The URL placeholder within yt-dlp command blocks in SKILL.md.
  • Boundary markers: All provided command examples wrap the user input in double quotes (e.g., yt-dlp "URL"), which is a standard security measure.
  • Capability inventory: The skill triggers the execution of yt-dlp to fetch and process remote content.
  • Sanitization: The use of shell quoting serves as basic sanitization against common command injection attempts within the URL string.
Audit Metadata
Risk Level
SAFE
Analyzed
Nov 1, 2026, 09:33 PM