music-download

Pass

Audited by Gen Agent Trust Hub on Jul 31, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The script scripts/extract_cookies.py utilizes the browser-cookie3 library to extract authentication cookies from browsers including Chrome, Edge, and Brave for music platform domains (e.g., qq.com, 163.com). These session tokens are stored in a local file (qq-cookies.txt) with restricted filesystem permissions (chmod 600) to enable authenticated API requests. While this is a documented feature for high-quality downloads, it involves accessing highly sensitive user data.
  • [EXTERNAL_DOWNLOADS]: The scripts/setup.sh script installs the external Python packages musicdl and browser-cookie3 from the official Python Package Index (PyPI) to provide the skill's core functionality.
  • [COMMAND_EXECUTION]: The scripts/compress_for_import.py script invokes the ffmpeg system utility via subprocess.run to re-encode audio files. The script uses a structured list for command arguments, which prevents shell command injection vulnerabilities.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 31, 2026, 10:07 AM
Security Audit — agent-trust-hub — music-download