music-download
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The script
scripts/extract_cookies.pyutilizes thebrowser-cookie3library to extract authentication cookies from browsers including Chrome, Edge, and Brave for music platform domains (e.g., qq.com, 163.com). These session tokens are stored in a local file (qq-cookies.txt) with restricted filesystem permissions (chmod 600) to enable authenticated API requests. While this is a documented feature for high-quality downloads, it involves accessing highly sensitive user data. - [EXTERNAL_DOWNLOADS]: The
scripts/setup.shscript installs the external Python packagesmusicdlandbrowser-cookie3from the official Python Package Index (PyPI) to provide the skill's core functionality. - [COMMAND_EXECUTION]: The
scripts/compress_for_import.pyscript invokes theffmpegsystem utility viasubprocess.runto re-encode audio files. The script uses a structured list for command arguments, which prevents shell command injection vulnerabilities.
Audit Metadata