The Agent Skills Directory

[COMMAND_EXECUTION]: The script executes yt-dlp and pip using subprocess.run(). It correctly passes arguments as a list rather than a single string, which prevents shell injection vulnerabilities.
[EXTERNAL_DOWNLOADS]: The skill automatically installs the yt-dlp package from the official Python Package Index (PyPI) if it is missing. This is a standard and safe method for ensuring necessary tools are available for the skill's primary function.
[DATA_EXPOSURE]: The skill saves downloaded media to a designated output directory (/mnt/user-data/outputs/) by default, adhering to standard agent environment practices for file management.
[INDIRECT_PROMPT_INJECTION]: The skill fetches video metadata, such as titles and uploader information, from external YouTube URLs. While this metadata is used for display and filenames, it represents a standard surface for indirect prompt injection common to tools that process external content. No malicious exploitation of this surface was detected in the skill's code.

video-downloader