Add download_file capability and security check