CLI download tools for YouTube and WeChat

This package is internally consistent, but consider these practical points before installing: - It runs yt-dlp and curl to fetch content from user-supplied URLs and writes files to your current directory and /tmp. Ensure you run it from a safe working directory. - yt-dlp can be used to download copyrighted content; verify you have the right to download the media you target. - Some videos or WeChat articles may require cookies or login; the scripts mention using browser cookies or proxies but do not automatically access them — if you follow those suggestions you may expose browser data or credentials, so be cautious and understand the commands you run (e.g., --cookies-from-browser). - The install uses Homebrew; confirm you trust Homebrew on your machine and that you want yt-dlp/ffmpeg installed system-wide. - As with any third-party script, review the script sources (provided) before running, and keep yt-dlp/ffmpeg updated from their official sources.

Type: OpenClaw Skill Name: download-tools Version: 1.0.0 The skill bundle is classified as suspicious due to path traversal vulnerabilities in both `wechat-dl.sh` and `yt-audio.sh`. Both scripts take an output filename from user input (`$2`) and use it directly to construct file paths (e.g., `"${OUTPUT}.txt"`, `"${OUTPUT_NAME}.%(ext)s"`). This allows an attacker to specify paths like `../../etc/passwd` to write files to arbitrary locations on the system. While the core functionality is benign, these vulnerabilities could be exploited for unauthorized file modification or creation, making the skill suspicious rather than malicious, as there is no clear evidence of intentional harmful behavior like data exfiltration or persistence.