Youtube Hq Downloader

Youtube Highest Quality Downloader - Download highest quality silent video and pure audio from YouTube, then merge into video with sound

This skill appears to do what it says (download and merge YouTube video/audio) but take precautions before running: 1) Inspect the code yourself (download.py and download.sh) and confirm you trust the yt-dlp package source. 2) Run the scripts inside an isolated environment (container or VM) rather than as your main user. 3) Do not pass untrusted/remote-provided URLs without sanitizing: the scripts interpolate the URL into shell commands (subprocess.run with shell=True and the bash script), which can allow command injection if an attacker controls the URL. 4) Note the shell script may source another skill's virtualenv ($HOME/clawd/skills/video-subtitles/.venv); verify that venv's contents before allowing it to be sourced. 5) To harden: use subprocess.run with argument lists (no shell=True) or shlex.quote inputs, and prefer to pip-install packages into an isolated venv manually. Also consider copyright/legal issues when downloading YouTube content.

Type: OpenClaw Skill Name: youtube-hq-downloader Version: 1.0.1 The skill is classified as suspicious due to critical shell injection vulnerabilities in both `download.sh` and `download.py`. In `download.sh`, the `ls ${OUTPUT_NAME}_video.*` command uses an unsanitized user-controlled `OUTPUT_NAME` variable, allowing arbitrary command execution. In `download.py`, the use of `subprocess.run(..., shell=True)` and `os.system()` with f-strings embedding user-controlled `url` and `output_name` variables, even when quoted, presents a high risk of shell injection if the inputs contain malicious characters that can break out of the quotes. These vulnerabilities could lead to arbitrary code execution on the agent's host machine, but there is no clear evidence of intentional malicious behavior (e.g., data exfiltration or backdoors), classifying it as a vulnerability rather than malware.