music-download

SUSPICIOUS: the main download/transcode workflow is coherent and uses official-looking upstream tooling, but the skill expands into sensitive browser-cookie extraction and forwards those credentials through local helper scripts that were not provided for review. This is not clearly malicious, yet the credential-handling and unpinned dependency chain make it medium risk.

This module performs local browser cookie harvesting and exports authentication/session cookies for a chosen domain into a file, which is a high-sensitivity credential-handling behavior. While the code fragment contains no obvious obfuscation and no network exfiltration, it can directly produce reusable session artifacts, making the security impact strongly dependent on the surrounding package intent and distribution context. Treat as credential-stealing-adjacent and ensure tight supply-chain controls, provenance review of dependencies (browser_cookie3), and restrict execution/outputs in trusted environments only.