bilibili-video-download
Warn
Audited by Gen Agent Trust Hub on Apr 3, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes various shell commands to manage the download environment and perform tasks. It includes installation commands such as
uv tool install yutto,pip install yutto, andbrew install yutto. It usesmkdir -pto create download directories and executesyuttooruvx yuttowith user-supplied URLs and directory paths. It also executesffmpeg -versionto verify system requirements and usesenv -uto clear proxy-related environment variables for troubleshooting connectivity issues. - [COMMAND_EXECUTION]: The skill suggests using
sudoto install theffmpegdependency on Linux systems (e.g.,sudo apt install ffmpeg,sudo pacman -S ffmpeg). This involves privilege escalation which may be restricted or risky in certain environments. - [EXTERNAL_DOWNLOADS]: The skill downloads and installs external software at runtime. It fetches the
yuttopackage from Python package registries or GitHub and downloadsffmpegusing system package managers like Homebrew or APT. - [CREDENTIALS_UNSAFE]: The skill handles sensitive Bilibili authentication credentials. It provides instructions for manual cookie-based authentication using
SESSDATAandbili_jcttokens. While it prefers interactive login (yutto auth login), the inclusion of manual token handling in command arguments can expose credentials in process lists or shell history.
Audit Metadata