mk-youtube-get-audio

This module is a typical bootstrapper/locator for ffmpeg: it searches system paths and a project `bin/` directory, and if missing it executes a sibling download helper. No explicit malicious behavior (e.g., backdoor, credential theft, exfiltration, or obfuscated execution) is visible in this file. The main supply-chain risk is that integrity/verification of downloaded binaries and the helper script’s behavior are not verifiable from this snippet; downstream execution will likely trust the exported `FFMPEG` path.

SUSPICIOUS. The core behavior matches a YouTube-audio skill, but first-run auto-downloads and multi-browser cookie fallback increase trust and credential-handling risk beyond a simple downloader. Data flow is still mainly to YouTube and uses known tools, so this is not confirmed malware; it is a medium-risk skill with disproportionate auth access for convenience features.