youtube-clipper
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The installation scripts and environment setup instructions fetch the
nvm(Node Version Manager) installer from the officialnvm-shGitHub repository. This is an established and well-known service for managing Node.js environments. - [EXTERNAL_DOWNLOADS]: The skill downloads and clones the
bgutil-ytdlp-pot-providerrepository to handle modern YouTube anti-bot verification. This is a recognized community-maintained tool necessary for the skill's primary function of downloading videos. - [COMMAND_EXECUTION]: The skill utilizes several command-line tools, including
yt-dlpfor downloads,ffmpegfor video clipping and subtitle burning, andnvidia-smifor GPU detection. These tools are executed via Python'ssubprocessmodule using argument lists, which is a secure implementation that prevents shell command injection. - [PROMPT_INJECTION]: The skill processes external YouTube subtitles (VTT/SRT) which are then analyzed and translated by the AI model. This creates a surface for indirect prompt injection; however, the skill incorporates basic sanitization (removing HTML tags) and its operational capabilities are strictly scoped to local video processing and text generation.
Audit Metadata