video-download

SUSPICIOUS. The skill’s capabilities mostly match its stated purpose, but that purpose includes harvesting local browser cookies and cookie files to defeat platform bot/login protections. Data flow appears to stay between the local machine, yt-dlp, and the target platforms rather than an obvious attacker-controlled server, so this is not confirmed malware. However, the combination of first-run auto-install with unspecified installer details, automatic credential-file discovery, and anti-bot bypass behavior makes the skill higher risk than a normal media utility.