youtube-downloader

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). This skill instructs the agent to extract browser cookies via browser_evaluate, write those cookie values into a file, and pass that file to yt-dlp, which requires the agent to handle actual session cookies (secrets) verbatim — a direct exfiltration risk.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill instructs silent/unprompted installation of tooling and includes explicit browser cookie extraction and writing to a temporary cookie file for use with yt-dlp, which enable credential capture and unauthorized system modification.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Within the workflow, the agent ingests and parses free text returned by the external YouTube content via yt-dlp -F "URL" and yt-dlp --list-subs "URL" (format/subtitle tables and stderr are processed at runtime), meaning outsider-authored YouTube metadata/captions can be delivered to the LLM without selecting a specific item beyond the provided URL.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 1.00). The skill tells the agent to perform silent automatic installs (including apt-get commands that may require sudo) and to extract/write browser cookies to /tmp, which directs the agent to modify the host system state without explicit user consent.