YouTube Video Downloader

Download YouTube videos with customizable quality and format options. Use this skill when the user asks to download, save, or grab YouTube videos. Supports v...

This skill appears to do what it says: it runs yt-dlp to download single YouTube videos and includes a Python script to do that. Before installing/using it, consider: (1) the script will try to install yt-dlp via pip at runtime and uses --break-system-packages — run it in an isolated environment (virtualenv, container) to avoid altering system Python packages; (2) the pip install is not pinned to a specific yt-dlp version, which is a supply‑chain risk — you may prefer to pre-install a known-good yt-dlp version; (3) downloads default to /mnt/user-data/outputs — verify disk space and that this location is acceptable; (4) ensure downloading content complies with YouTube's terms and applicable laws; (5) if you need extra assurance, review or run the script in a sandboxed environment before granting it to an agent with network access.

Type: OpenClaw Skill Name: yt-video-downloader Version: 1.0.0 The `scripts/download_video.py` script is vulnerable to arbitrary file write due to insufficient sanitization of the user-provided `--output` path. This path is directly passed to `yt-dlp`'s `-o` argument, potentially allowing a malicious user to write files to sensitive system locations (e.g., `/etc/passwd`, `/root/.ssh/authorized_keys`) if the agent's permissions allow it. Additionally, the URL argument is passed directly to `yt-dlp` without sanitization, posing a potential (though lower) risk of shell injection if `yt-dlp` itself has a vulnerability in URL parsing. While the skill's stated purpose is benign, these vulnerabilities present a significant security risk.