yt-dlp

HIGH W008: Secret detected in skill content (API keys, tokens, passwords).

• Secret detected (high risk: 1.00). I inspected the repository files for literal, high-entropy credentials. I found a long token-like string embedded in a XiaoHongShu example URL (workflows/xhs-download.md). This value appears to be a real xsec_token (high-entropy, not a placeholder), so I flag it as a potential secret.

I ignored many other credential-like examples in the docs (e.g., "password", "pass123", "mypassword123", "YOUR_API_KEY", placeholders like USERNAME/PASSWORD, cookie names, proxy examples, and simple demo credentials) because they are low-entropy, clearly example or placeholder values per the provided rules and therefore not secrets.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.70). The skill explicitly instructs running a privileged command ("sudo apt install ffmpeg"), which directs the agent/user to obtain sudo privileges and modify the host system state.