dlai-transcript-fetcher

Pass

Audited by Gen Agent Trust Hub on Apr 14, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill downloads VTT subtitle files from video.deeplearning.ai and CloudFront domains. These are the official content delivery networks used by the service.
  • [COMMAND_EXECUTION]: Uses curl with the -L flag to download remote subtitle files to the local file system. It also executes a Python script generated during the session to parse these files.
  • [REMOTE_CODE_EXECUTION]: The setup instructions direct the user to configure the chrome-devtools-mcp using npx, which downloads and executes the latest version of the MCP server. This is a standard procedure for enabling browser-based agent capabilities.
  • [DYNAMIC_EXECUTION]: The agent is instructed to write a Python script (using re and os modules) to the local project directory and execute it to transform raw VTT data into Markdown. The script logic is statically defined in the skill instructions and performs string manipulation on the downloaded content.
  • [DATA_EXPOSURE]: The skill requires enabling remote debugging in Chrome (chrome://inspect/#remote-debugging). This configuration allows the agent (via the MCP) to inspect network traffic and page content, which is necessary to identify the dynamically generated VTT resource URLs.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 14, 2026, 02:52 AM
Security Audit — agent-trust-hub — dlai-transcript-fetcher