video-download

Pass

Audited by Gen Agent Trust Hub on Oct 26, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions involve executing yt-dlp and ffmpeg shell commands to process media. This is the intended and primary function of the skill.
  • [INDIRECT_PROMPT_INJECTION]: The skill possesses a data ingestion surface by processing external URLs which are passed to the yt-dlp command-line utility.
  • Ingestion points: External video URLs provided by the user or found in conversation are passed to shell commands in SKILL.md.
  • Boundary markers: The skill utilizes double quotes (e.g., "URL") around the input parameter to mitigate shell injection risks.
  • Capability inventory: The skill has the capability to execute shell commands, perform network requests to media hosting sites, and write media files to the local file system (documented in SKILL.md).
  • Sanitization: The skill relies on standard shell quoting within its command templates to manage external input.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 26, 2026, 06:31 PM