The Agent Skills Directory

[Unverifiable Dependencies] (MEDIUM): The script scripts/download_video.py automatically installs yt-dlp using pip install --break-system-packages at runtime. This introduces a dependency on an external package registry (PyPI) without version pinning or integrity verification.
Evidence: scripts/download_video.py line 21.
[Command Execution / Argument Injection] (HIGH): The url parameter provided by the user is passed directly to subprocess.run as an argument to yt-dlp. Since the input is not validated to be a legitimate URL, an attacker could provide strings starting with dashes (e.g., --exec 'cat /etc/passwd') to inject arbitrary flags into the yt-dlp command, leading to remote code execution.
Evidence: scripts/download_video.py line 77.
[Indirect Prompt Injection] (HIGH): The skill processes untrusted external metadata (YouTube video titles) and uses them to construct file system paths. This creates an attack surface where a maliciously titled video could influence the agent's file operations.
Ingestion points: Metadata is fetched via yt-dlp --dump-json in scripts/download_video.py line 27.
Boundary markers: None. The title is interpolated directly into the output template.
Capability inventory: File system writes (line 74) and subprocess execution (line 92).
Sanitization: Absent. The script relies on yt-dlp's internal handling of the %(title)s template variable, which may be insufficient to prevent all forms of path manipulation in the context of the agent's broader file system permissions.

youtube-downloader