The Agent Skills Directory

[COMMAND_EXECUTION]: The script uses the subprocess module to call yt-dlp and pip. All commands are executed by passing arguments as lists rather than shell strings, which effectively prevents command injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill installs the yt-dlp package from the official Python Package Index (PyPI) when setting up its local execution environment. This setup occurs within a skill-local virtual environment (.venv) to ensure isolation from the system Python.
[REMOTE_CODE_EXECUTION]: The skill communicates with verified YouTube domains to retrieve metadata and video content. A validation layer is implemented to ensure that only HTTPS URLs from permitted hostnames (such as youtube.com and youtu.be) are processed.
[SAFE]: Technical analysis reveals no malicious patterns. The skill's behavior is consistent with its stated purpose, and it incorporates robust safeguards for input validation and environment management.

youtube-downloader