The Agent Skills Directory

[COMMAND_EXECUTION] (HIGH): The script scripts/download.sh uses "$@" to pass all user-provided arguments directly to yt-dlp. Many CLI tools, including yt-dlp, support flags like --exec or --downloader-args that allow for arbitrary shell command execution. An attacker could trick the agent into including these flags in the argument list to compromise the host system.
[REMOTE_CODE_EXECUTION] (HIGH): Indirect prompt injection via the command-line interface. Since yt-dlp is designed to process untrusted external content (URLs), the lack of argument sanitization allows for a 'parameter injection' attack where metadata or URLs provided by a third party could be crafted to include malicious flags.
[EXTERNAL_DOWNLOADS] (HIGH): The documentation in references/guide.md and references/usage.md explicitly recommends an insecure installation method: sudo curl -L [URL] -o /usr/local/bin/yt-dlp && sudo chmod a+rx. This pattern encourages users to execute remote scripts with root privileges without verifying integrity.
[CREDENTIALS_UNSAFE] (MEDIUM): The skill promotes the use of --cookies-from-browser. While a standard feature of yt-dlp, in the context of an AI agent, this provides the agent (and potentially a remote attacker via prompt injection) access to the user's active session cookies for various websites.
[INDIRECT PROMPT INJECTION] (HIGH):
Ingestion points: User-supplied <URL> and [OPTIONS] in scripts/download.sh.
Boundary markers: None present. User inputs are appended directly to the command string.
Capability inventory: Full subprocess execution via yt-dlp which itself has command-execution capabilities (--exec).
Sanitization: None. The script does not validate or escape the input arguments before execution.

yt-dlp