media-ytdlp
Pass
Audited by Gen Agent Trust Hub on Jun 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill facilitates the execution of
yt-dlpandffmpegbinaries to process media downloads. The helper scriptscripts/ytdlp.pyutilizessubprocess.call()andsubprocess.run()to invoke these CLI tools. This is the core intended functionality and uses safe argument passing (list-based) to mitigate shell injection risks. - [EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing and updating
yt-dlpandffmpegusing official package managers including Homebrew (brew install) and PyPI (pip install). These are recognized as trusted, well-known services. - [CREDENTIALS_UNSAFE]: The skill includes documentation on using browser cookies (
--cookies-from-browser) to access private or age-restricted content. This is a standard and necessary feature of theyt-dlptool for authenticated access, and the skill correctly warns users about the implications of sharing cookie files. - [DATA_EXFILTRATION]: While the skill performs network operations to many external media hosting domains, this is the primary purpose of the downloader. No unauthorized data transmission or exfiltration of sensitive local data was detected.
Audit Metadata