baixar-musica
Pass
Audited by Gen Agent Trust Hub on Oct 26, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes external CLI tools (
yt-dlp) and a specific PowerShell script located at~\baixar_audio.ps1. It uses the PowerShell call operator (&) to run the local script with user-supplied arguments (URLs). - [EXTERNAL_DOWNLOADS]: The skill uses
yt-dlpto download content from YouTube, a well-known service, to the local filesystem (specifically%USERPROFILE%\Music\YouTube Audio). - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external source (YouTube video titles and channel names) which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Metadata returned by the
yt-dlpsearch command inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when displaying search results.
- Capability inventory: The skill has the ability to execute shell commands and write files to the user's Music directory.
- Sanitization: The skill includes a manual verification step requiring the user to confirm the search results before proceeding with the download, which serves as a human-in-the-loop security control.
Audit Metadata