The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill instructs the agent to access sensitive user data by utilizing the --cookies-from-browser flag and local cookies.txt files to facilitate downloads of restricted or private content.
[COMMAND_EXECUTION]: The instructions explicitly mandate the disabling of SSL/TLS certificate verification across all supported tools using flags such as --no-check-certificates, --insecure, and --check-certificate=false, which degrades network security and exposes the environment to potential Man-in-the-Middle (MITM) interception.
[EXTERNAL_DOWNLOADS]: The skill facilitates the installation of standard media processing tools including gallery-dl from the official Python package registry and yt-dlp, ffmpeg, and aria2c via the Microsoft Winget package manager.
[INDIRECT_PROMPT_INJECTION]:
Ingestion points: The skill downloads and processes content from arbitrary, untrusted web URLs provided by the user (SKILL.md, scripts/download.sh).
Boundary markers: None identified (Absent).
Capability inventory: Extensive shell command execution capabilities involving yt-dlp, curl, gallery-dl, aria2c, wget, and httrack, along with the ability to write files to the local file system.
Sanitization: No mechanisms are present to sanitize or validate the content or metadata of downloaded files before they are introduced into the agent's context.

universal-downloader