The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill explicitly instructs the agent to use the --cookies-from-browser chrome flag. This grants the yt-dlp process access to the user's sensitive browser profile, potentially exposing session tokens, login credentials, and authentication cookies for YouTube and any other sites the user is logged into.
[COMMAND_EXECUTION]: The skill executes multiple shell commands, including uvx yt-dlp and ls -la, which incorporate user-controlled variables such as $VIDEO_URL and OUTPUT_PATH. This allows the agent to interact with the local file system and execute external tools based on user input.
[INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data that is directly used in shell commands, creating a vulnerability surface where a malicious URL or video title could influence agent behavior.
Ingestion points: The $VIDEO_URL variable in SKILL.md (Step 2 and Step 4) and the user-defined OUTPUT_PATH (Step 3).
Boundary markers: None. The instructions do not define delimiters for the URL or provide instructions for the agent to ignore potentially malicious content within the URL string or video metadata.
Capability inventory: The skill can execute shell commands via uvx, list directory contents using ls, and write arbitrary files to the disk using the yt-dlp output flags.
Sanitization: There are no validation or sanitization steps mentioned to ensure the URL or output path are safe before being passed to the shell environment.
[EXTERNAL_DOWNLOADS]: The skill uses uvx to dynamically fetch and run yt-dlp. While yt-dlp is a legitimate tool, the skill relies on fetching it from an external package registry at runtime.
[REMOTE_CODE_EXECUTION]: By using uvx to execute a package downloaded at runtime, the skill performs remote code execution. If the package registry or the specific package is compromised, it could lead to the execution of malicious code on the host system.

youtube-download