video-download
Pass
Audited by Gen Agent Trust Hub on Sep 13, 2026
Risk Level: SAFE
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill processes external data via video URLs, creating a surface for indirect prompt injection through media metadata. This is inherent to the tool's purpose. Ingestion points: Metadata fetched from external websites (SKILL.md). Boundary markers: Absent. Capability inventory: yt-dlp execution for file writing and metadata dumping (SKILL.md). Sanitization: Absent.
- [COMMAND_EXECUTION]: The skill uses the yt-dlp command-line utility. Commands are properly structured with URL placeholders in quotes to prevent simple shell injection from malformed inputs.
Audit Metadata