The Agent Skills Directory

[COMMAND_EXECUTION]: The skill builds shell commands by interpolating variables like $VIDEO_URL, OUTPUT_PATH, and video metadata fields such as %(title)s. If these strings contain shell-specific characters (e.g., semicolons, backticks), they could trigger the execution of unintended, malicious commands.
[CREDENTIALS_UNSAFE]: Instructions specify the use of the --cookies-from-browser chrome flag. This allows the yt-dlp tool to read the user's browser cookies, potentially exposing session tokens and private authentication data if the execution context is manipulated.
[REMOTE_CODE_EXECUTION]: The skill uses uvx to automatically install and run yt-dlp from the web. While these are common tools, this mechanism involves executing code retrieved at runtime.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from external sources (video metadata like titles and descriptions) and uses it to drive subsequent agent actions and command construction.
Ingestion points: The VIDEO_URL provided by the user and the resulting JSON metadata retrieved in Step 2 of SKILL.md.
Boundary markers: None; the skill lacks delimiters or instructions to treat external metadata as untrusted.
Capability inventory: Execution of shell commands via uvx, file system write operations, and directory listing (ls).
Sanitization: There is no logic to sanitize or escape characters in the URL, output path, or video title before they are placed into shell command strings.
[DYNAMIC_EXECUTION]: Executable shell commands are dynamically generated and assembled based on runtime information and user choices, which increases the likelihood of injection vulnerabilities.

youtube-download