video-downloader

Pass

Audited by Gen Agent Trust Hub on Jun 18, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes a Python script (assets/downloader.py) to manage video processing. This script includes safety features like sanitize_filename to prevent directory traversal or filename injection attacks when saving content to the local filesystem.
  • [EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's API at redfox.hk to resolve video links and subsequently downloads media files. This network activity is strictly limited to the skill's primary function of media retrieval.
  • [CREDENTIALS_UNSAFE]: The skill handles an API key (REDFOX_API_KEY) required for the RedFox service. It implements localized credential storage in ~/.qoder/apis/redfox.json and uses os.chmod to restrict file permissions (0o600), ensuring the secret is only readable by the owner.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 18, 2026, 12:31 PM
Security Audit — agent-trust-hub — video-downloader