youtube-downloader

No definitive malicious activity is present in the wrapper code itself (no stealth, no credential/data theft, no exfiltration logic). The primary security concern is operational and supply-chain risk: the program may download and install `yt-dlp` at runtime via `pip install --break-system-packages`, then executes it with an unvalidated user-provided `url` and a user-influenced output template that leads to filesystem writes. This should be treated as a security-sensitive downloader wrapper rather than trusted application logic. Pin yt-dlp versions, avoid runtime installs in production, and restrict/validate allowed URL schemes/hosts as appropriate for the threat model.