The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/download.sh is vulnerable to shell command injection. It constructs a command string by appending the user-provided $URL variable and then executes it using eval. Because the script only wraps the URL in escaped double quotes without further sanitization, an attacker can break out of the string using a double-quote character and execute arbitrary system commands (e.g., "; id; #).
[DATA_EXFILTRATION]: The scripts/download.sh script discloses sensitive local environment information. Specifically, it hardcodes an absolute path to the author's local machine (/Users/ikatkov/.codex/skills/...) in an error message, which reveals the host's directory structure and username to any user encountering that error.
[COMMAND_EXECUTION]: The skill instructs the agent to use the --cookies-from-browser flag for YouTube downloads. While this is a native feature of yt-dlp, in an automated agent context, it grants the tool access to the user's private browser session data (e.g., YouTube/Google login cookies). This increases the impact of any potential URL-based exploitation or indirect prompt injection.

yt-dlp