video-downloader
Pass
Audited by Gen Agent Trust Hub on Jun 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a Python script (
assets/downloader.py) to manage video processing. This script includes safety features likesanitize_filenameto prevent directory traversal or filename injection attacks when saving content to the local filesystem. - [EXTERNAL_DOWNLOADS]: The skill communicates with the vendor's API at
redfox.hkto resolve video links and subsequently downloads media files. This network activity is strictly limited to the skill's primary function of media retrieval. - [CREDENTIALS_UNSAFE]: The skill handles an API key (
REDFOX_API_KEY) required for the RedFox service. It implements localized credential storage in~/.qoder/apis/redfox.jsonand usesos.chmodto restrict file permissions (0o600), ensuring the secret is only readable by the owner.
Audit Metadata