yt-dlp-downloader

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). RUNTIME path: the operating user supplies a video URL, which is passed as a command-line argument to subprocess.run(["yt-dlp", url, ...]); yt-dlp then fetches and parses outsider-authored public web content from that URL (e.g., the video page/metadata), which can influence the LLM-visible output (stdout/stderr) returned by main.py.