yt-dlp

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The required runtime workflow executes scripts/download.sh, which takes a user-supplied URL and runs yt-dlp against it; yt-dlp fetches and parses arbitrary web pages from that URL (outsider-authored public web content) and feeds extracted metadata/text into the LLM context via the agent’s command execution/output handling.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly demands "escalation permission mode" and broad shell permissions (required_permissions: ["all", "network"]), and instructs running shell commands (including installing packages and accessing browser cookies), which encourages obtaining elevated privileges and broad system access that can modify machine state.