The Agent Skills Directory

[DATA_EXFILTRATION]: The dl-video.sh script automatically attempts to read session cookies from Chrome, Firefox, and Edge browser profiles to bypass restrictions on media platforms like Bilibili. This involves access to sensitive local session data.\n- [PRIVILEGE_ESCALATION]: The install-toolkit.sh script utilizes sudo for system-wide package installation on Linux distributions, which requires elevated execution rights.\n- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from numerous untrusted external sources, including media metadata and search engine results. This creates a surface for indirect prompt injection as these inputs are parsed without explicit sanitization.\n
Ingestion points: External media URLs and metadata parsed by yt-dlp and gallery-dl (scripts/dl-video.sh, scripts/dl-gallery.sh), and search pages from cloud drive engines (references/cloud-search.md).\n
Boundary markers: Absent.\n
Capability inventory: Network access via multiple tools (curl, wget, aria2c), local file system write capabilities, and execution of shell commands.\n
Sanitization: None detected for externally-sourced metadata.\n- [COMMAND_EXECUTION]: The skill provides scripts and instructions for running various download tools and a management daemon (aria2 JSON-RPC) without a security token. If exposed to the network, this could allow unauthorized control over the host system's download operations.

download-anything