bilibili-video-download

Warn

Audited by Gen Agent Trust Hub on Apr 3, 2026

Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes various shell commands to manage the download environment and perform tasks. It includes installation commands such as uv tool install yutto, pip install yutto, and brew install yutto. It uses mkdir -p to create download directories and executes yutto or uvx yutto with user-supplied URLs and directory paths. It also executes ffmpeg -version to verify system requirements and uses env -u to clear proxy-related environment variables for troubleshooting connectivity issues.
  • [COMMAND_EXECUTION]: The skill suggests using sudo to install the ffmpeg dependency on Linux systems (e.g., sudo apt install ffmpeg, sudo pacman -S ffmpeg). This involves privilege escalation which may be restricted or risky in certain environments.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and installs external software at runtime. It fetches the yutto package from Python package registries or GitHub and downloads ffmpeg using system package managers like Homebrew or APT.
  • [CREDENTIALS_UNSAFE]: The skill handles sensitive Bilibili authentication credentials. It provides instructions for manual cookie-based authentication using SESSDATA and bili_jct tokens. While it prefers interactive login (yutto auth login), the inclusion of manual token handling in command arguments can expose credentials in process lists or shell history.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Apr 3, 2026, 08:15 AM