Video Dl

Download videos from YouTube, Reddit, Twitter/X, TikTok, Instagram, and 1000+ other sites using yt-dlp. Use when user provides a video link and wants to download it.

This skill largely does what it says (downloads videos using yt-dlp), but check a few things before installing or running it: - Ensure you have the required binaries installed from trusted sources: yt-dlp, ffmpeg and ffprobe. The skill does not declare these requirements but both scripts call them. - Note that the SKILL.md suggests a Telegram send flow, but compress-and-send.sh only compresses and prints success; it does not actually upload or notify Telegram. Treat the CHAT_ID parameter as informational only unless you modify the script to perform uploads. - The scripts write to ~/Downloads/videos by default and will download arbitrary URLs you pass in. Confirm you are comfortable with network downloads and legal/copyright implications for the content you request. - Because there is no installer, nothing is written to system locations by the skill itself, but the scripts will execute external binaries and write files to your home directory — run them in a controlled environment if you are unsure. If you plan to use this skill: verify yt-dlp and ffmpeg are installed and up-to-date, inspect or test the scripts locally, and consider running them in a sandbox or container if you are concerned about side effects.

Type: OpenClaw Skill Name: video-dl Version: 1.1.0 The skill bundle is classified as suspicious due to a critical shell injection vulnerability in `scripts/download.sh`. The script directly uses user-provided input for the `--output` argument in a `mkdir -p "$OUTPUT_DIR"` command without sanitization, allowing for arbitrary command execution. The `SKILL.md` further exposes this by instructing the agent to pass user-controlled options directly to the script. There is no evidence of intentional malicious behavior such as data exfiltration or backdoors.