media-ytdlp

Pass

Audited by Gen Agent Trust Hub on Jun 27, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill facilitates the execution of yt-dlp and ffmpeg binaries to process media downloads. The helper script scripts/ytdlp.py utilizes subprocess.call() and subprocess.run() to invoke these CLI tools. This is the core intended functionality and uses safe argument passing (list-based) to mitigate shell injection risks.
  • [EXTERNAL_DOWNLOADS]: The documentation provides instructions for installing and updating yt-dlp and ffmpeg using official package managers including Homebrew (brew install) and PyPI (pip install). These are recognized as trusted, well-known services.
  • [CREDENTIALS_UNSAFE]: The skill includes documentation on using browser cookies (--cookies-from-browser) to access private or age-restricted content. This is a standard and necessary feature of the yt-dlp tool for authenticated access, and the skill correctly warns users about the implications of sharing cookie files.
  • [DATA_EXFILTRATION]: While the skill performs network operations to many external media hosting domains, this is the primary purpose of the downloader. No unauthorized data transmission or exfiltration of sensitive local data was detected.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 27, 2026, 09:53 AM
Security Audit — agent-trust-hub — media-ytdlp