MCP-Servers

CRITICAL: The tools 'download_youtube_video' and 'download_youtube_audio' accept a 'url' parameter which is likely passed directly to a `subprocess.run` command that executes `yt-dlp`. Without explicit sanitization of the 'url' and if `shell=True` is used (a common but dangerous pattern), this creates a severe command injection vulnerability. An attacker could craft a malicious URL to execute arbitrary commands on the host system. Additionally, there is no mention of authentication or authorization, implying unauthenticated access to system resources for executing downloads. This lack of access control combined with potential command injection poses a high risk.