video-transcript-downloader
Pass
Audited by Gen Agent Trust Hub on Jul 27, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The script
./scripts/vtd.jsexecutes external binaries (yt-dlp,ffmpeg) usingnode:child_process. It properly resolves binary paths using a customwhichfunction and passes arguments as arrays to thespawnAPI, which prevents shell command injection. - [EXTERNAL_DOWNLOADS]: The skill downloads content from YouTube and other sites supported by
yt-dlp. It also uses theyoutube-transcript-plusNPM package. These are consistent with the skill's primary purpose and use well-known services. - [DATA_EXFILTRATION]: No evidence of credential harvesting or sensitive data exfiltration was found. The skill operates on user-provided URLs and saves output to a user-configurable directory (defaulting to
~/Downloads).
Audit Metadata