youtube-clipper

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The installation scripts and environment setup instructions fetch the nvm (Node Version Manager) installer from the official nvm-sh GitHub repository. This is an established and well-known service for managing Node.js environments.
  • [EXTERNAL_DOWNLOADS]: The skill downloads and clones the bgutil-ytdlp-pot-provider repository to handle modern YouTube anti-bot verification. This is a recognized community-maintained tool necessary for the skill's primary function of downloading videos.
  • [COMMAND_EXECUTION]: The skill utilizes several command-line tools, including yt-dlp for downloads, ffmpeg for video clipping and subtitle burning, and nvidia-smi for GPU detection. These tools are executed via Python's subprocess module using argument lists, which is a secure implementation that prevents shell command injection.
  • [PROMPT_INJECTION]: The skill processes external YouTube subtitles (VTT/SRT) which are then analyzed and translated by the AI model. This creates a surface for indirect prompt injection; however, the skill incorporates basic sanitization (removing HTML tags) and its operational capabilities are strictly scoped to local video processing and text generation.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 05:44 PM