baixar-musica

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes external CLI tools (yt-dlp) and a specific PowerShell script located at ~\baixar_audio.ps1. It uses the PowerShell call operator (&) to run the local script with user-supplied arguments (URLs).
  • [EXTERNAL_DOWNLOADS]: The skill uses yt-dlp to download content from YouTube, a well-known service, to the local filesystem (specifically %USERPROFILE%\Music\YouTube Audio).
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from an external source (YouTube video titles and channel names) which could potentially contain malicious instructions intended to influence the agent's behavior.
  • Ingestion points: Metadata returned by the yt-dlp search command in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded commands are used when displaying search results.
  • Capability inventory: The skill has the ability to execute shell commands and write files to the user's Music directory.
  • Sanitization: The skill includes a manual verification step requiring the user to confirm the search results before proceeding with the download, which serves as a human-in-the-loop security control.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 07:32 PM