YouTube Media Downloader

Download audio (MP3) and video (MP4) files from YouTube URLs. Use when users want to convert YouTube videos to files, extract music/songs, download videos fo...

This skill appears to do what it claims (download/convert YouTube media), but review and consider the following before installing or running it: - The bundled scripts download executables at runtime (yt-dlp and ffmpeg) via curl and extract them into $HOME without verifying checksums or signatures — this can be a supply-chain/tampering risk if network or upstream sources are compromised. Prefer installing yt-dlp and ffmpeg yourself from trusted package managers or verified releases, or modify the scripts to verify checksums/signatures. - The scripts write files into your home directory and make binaries executable; run them in a sandbox/container or as a limited user if you are concerned about filesystem changes. - There are no unexpected environment variables or secret accesses, and the behavior matches the description (playlist support, batch files, audio/video options). - If you plan to use this, inspect the scripts line-by-line and consider replacing the 'latest' download links with pinned versioned releases and adding integrity checks. Also be mindful of copyright and YouTube terms when downloading content.

Type: OpenClaw Skill Name: youtube-media-downloader Version: 1.0.0 The skill is suspicious due to severe shell injection vulnerabilities in `scripts/batch_download.sh` and `scripts/download_media.sh`. User-controlled input for output directories and filenames (e.g., via `-o` flag or `OUTPUT_FILENAME` argument) is directly interpolated into shell commands (e.g., `yt-dlp`, `ls`, `find`) without proper sanitization, allowing arbitrary command execution. Additionally, both scripts automatically download and execute external binaries (`yt-dlp` from `github.com/yt-dlp` and `ffmpeg` from `github.com/BtbN/FFmpeg-Builds`) from the internet, posing a significant supply chain risk if these external sources were compromised.