Skills
skills/monotykamary/browser-harness-js/ytdl/Gen Agent Trust Hub

ytdl

Fail

Audited by Gen Agent Trust Hub on Jul 17, 2026

Risk Level: HIGHCOMMAND_EXECUTION
Full Analysis
  • [COMMAND_EXECUTION]: The scripts/setup script modifies user shell configuration files (.zshrc, .bashrc, and .profile) to persistently append ~/.local/bin to the system PATH. This is a persistence mechanism that alters the user's environment to ensure the skill's CLI and dependencies are available in future sessions.
  • [COMMAND_EXECUTION]: The skill executes local system binaries including ffmpeg for muxing audio and video streams and browser-harness-js for browser automation via CDP. It implements a restrictive whitelist-based sanitization process for video titles and shell-escaping for URLs to mitigate the risk of shell command injection from external metadata.
  • [COMMAND_EXECUTION]: The scripts/ytdl component uses a shell heredoc to execute a JavaScript program that controls the browser session. It safely interpolates variables like the watch URL by applying multiple layers of escaping (backslashes, dollars, backticks, and single quotes) to prevent code injection within the execution context of the automation harness.
Recommendations
  • AI detected serious security threats
Audit Metadata
Risk Level
HIGH
Analyzed
Jul 17, 2026, 04:46 PM
Security Audit — agent-trust-hub — ytdl