The Agent Skills Directory

[CREDENTIALS_UNSAFE]: The skill implements a workflow to extract session cookies from the user's browser.
It uses Playwright to navigate to Google login pages and executes JavaScript (document.cookie) to harvest authentication tokens for .youtube.com and .google.com domains.
These sensitive session credentials are then written to a plaintext file at /tmp/yt-cookies.txt.
[EXTERNAL_DOWNLOADS]: The skill performs multiple automated and silent software installations.
It executes pip install for yt-dlp, ffmpeg-static, and imageio[ffmpeg] without user confirmation.
It attempts silent system-level installations using apt-get install -y nodejs and brew install node.
[COMMAND_EXECUTION]: The skill constructs and executes shell commands that incorporate external user-provided data.
User-provided URLs are interpolated directly into yt-dlp commands, creating a potential surface for command injection if the agent does not properly sanitize the input.
[DATA_EXFILTRATION]: The extraction of browser session cookies represents a significant data exposure risk. While the stated purpose is for authentication, these tokens grant full access to the user's account and are stored in an insecure temporary location.
[PRIVILEGE_ESCALATION]: The skill attempts to use system package managers (apt-get, brew) to install software, including instructions to use sudo for apt-get commands, which escalates the agent's permissions on the host system.

youtube-downloader