video-download

SUSPICIOUS. The core purpose is coherent with a video-downloading skill and the referenced yt-dlp ecosystem is legitimate, but the skill materially increases sensitivity by auto-reading browser cookies and exported cookie files to bypass platform anti-bot checks. The biggest risk is not obvious malware or third-party credential exfiltration; it is broad session-cookie handling plus an unspecified first-run installer path. If the implementation installs yt-dlp only from official PyPI/GitHub sources and keeps all requests directed to official platform endpoints, this is a high-sensitivity but plausibly legitimate downloader rather than a credential-stealing skill.