Find and download virtually any digital resource from the internet — ebooks, academic papers, movies, TV shows, music, software, images, fonts, courses, and...

What to consider before installing: - Functionality: The scripts do what they claim — orchestrate yt-dlp, aria2, gallery-dl, spotdl, etc. — and the install script uses standard package managers. - Local secrets/configs: The instructions repeatedly recommend using browser cookies (yt-dlp --cookies-from-browser), gallery-dl OAuth, and tool config files. These actions require access to your local browser profile and config files; only proceed if you understand and accept that. - Insecure RPC: Documentation examples show running aria2 with RPC options (listen-all / allow-origin-all). Do NOT enable aria2 JSON-RPC bound to all interfaces or without authentication on an untrusted network — it exposes a remote-control surface for downloads. - Legal & safety: The references include “shadow libraries”, cloud-drive search engines, and torrent/DDL workflows. This increases legal and malware risk depending on what you download. The skill’s purpose is broad (including infringing content); that’s a policy/legal risk you must evaluate. - Audit before running: Read the included scripts (they are plain shell) and the installer to ensure you’re comfortable with each command. Prefer running in a sandbox/VM/container or an isolated account rather than your primary workstation. - Use trusted hosts: Examples that call external services (Cobalt examples, self-hosted instances) require you to trust the service; avoid sending URLs or data to public/untrusted endpoints. - If you proceed: install packages manually rather than running the installer blindly, avoid enabling aria2 RPC without auth, and avoid providing browser cookies to untrusted processes. If you want, I can highlight the exact lines that access cookies/configs and show a safer aria2 startup example (RPC restricted to localhost with token).

Type: OpenClaw Skill Name: download-anything Version: 0.1.1 The skill is classified as suspicious due to several high-risk capabilities and potential vulnerabilities, despite its stated purpose of downloading digital resources. Key indicators include the use of `yt-dlp --cookies-from-browser` in `scripts/dl-video.sh`, which grants the skill access to the user's browser session cookies for authenticated downloads. Additionally, `scripts/dl-gallery.sh` passes arbitrary extra arguments to `gallery-dl`, posing a potential shell injection vulnerability if `gallery-dl` supports dangerous execution arguments. The documentation (`references/*.md`) also explicitly directs the agent/user to 'shadow libraries,' torrent sites, and DDL sites, which are often associated with copyright infringement and potentially malware-laden content, significantly increasing the risk surface. Finally, the `scripts/install-toolkit.sh` requires `sudo` for package installations, granting broad system access during setup.