Yt Dlp

A robust CLI wrapper for yt-dlp to download videos, playlists, and audio from YouTube and thousands of other sites. Supports format selection, quality control, metadata embedding, and cookie authentication.

This skill is a thin wrapper around yt-dlp and appears coherent. Before installing/using it: 1) ensure yt-dlp and ffmpeg are installed from official sources (pip, your OS package manager, or official GitHub releases) instead of running random curl|sh installers; 2) inspect the bundle (especially scripts/download.sh) — it attempts to use a .venv yt-dlp if present and otherwise calls system yt-dlp; 3) be cautious with cookies: using --cookies-from-browser can expose browser session cookies — prefer exporting a cookies.txt file and review it; 4) note a minor packaging gap: the script mentions 'scripts/setup' but that file is not included, so the script may fail if yt-dlp isn't already available. If you plan to let an autonomous agent use this skill, explicitly restrict use of browser cookies and confirm you trust the agent to run local commands that may write files to your download directory.

Type: OpenClaw Skill Name: yt-dlp Version: 1.0.1 The skill is classified as suspicious due to a critical shell injection vulnerability in `scripts/download.sh`. The script directly passes user-supplied arguments (`"$@"`) to the `yt-dlp` command without proper sanitization, allowing an attacker to execute arbitrary shell commands by injecting metacharacters into the input. Additionally, the skill exposes the high-risk `yt-dlp` feature `--cookies-from-browser`, which can access sensitive browser session cookies, although this capability is documented with a warning in `SKILL.md` and `references/guide.md`.