The Agent Skills Directory

Unverifiable Dependencies & Remote Code Execution (LOW): The script automatically installs the yt-dlp package from PyPI if it is not found on the system during execution.
Evidence: subprocess.run([sys.executable, "-m", "pip", "install", "--break-system-packages", "yt-dlp"], check=True) in scripts/download_video.py.
Indirect Prompt Injection (LOW): The skill accepts a URL from the user and passes it to an external tool (yt-dlp) to fetch metadata and video content.
Ingestion point: url argument in scripts/download_video.py.
Boundary markers: None.
Capability: Executing yt-dlp to fetch metadata and download files to the local file system.
Sanitization: The script uses subprocess.run with a list of arguments (execvp-style) rather than a shell string, which effectively prevents shell command injection via the URL parameter.

youtube-downloader