Video Download FaaS

Download videos in MP4 format using yt-dlp with FaaS (Firecracker/Container) isolation. Start downloads, check status, and kill processes. Videos are automat...

This skill appears coherent for running background downloads with yt-dlp. Before installing, ensure you: (1) have yt-dlp installed and trust running it on the host; (2) run the scripts only on systems you control (downloads access remote URLs and may consume bandwidth/storage); (3) be aware the SKILL.md mentions a run-in-container.sh helper that is not included — if you need containerized isolation, add or review such a wrapper yourself; (4) verify output directory permissions and be cautious of executing or opening downloaded files from untrusted sources; and (5) consider running the scripts inside a container or VM if you want stricter isolation. There are no detected exfiltration endpoints or secret-collection behaviors in the shipped scripts.

Type: OpenClaw Skill Name: video-download-faas Version: 1.0.0 The skill bundle contains multiple critical shell injection vulnerabilities across all three scripts. In `scripts/download.sh`, the `output_directory` parameter is directly interpolated into `mkdir -p` and `yt-dlp -o`, allowing arbitrary command execution. In `scripts/check-status.sh` and `scripts/kill-download.sh`, the `session_id` parameter is directly used in file paths for commands like `cat`, `grep`, `sed`, `ls`, and `rm`, leading to shell injection. These flaws enable an attacker to execute arbitrary commands on the host system, but there is no evidence of intentional malicious behavior within the provided code, classifying it as suspicious due to severe vulnerabilities.