youtube-clipper

No direct malicious payload is evident in the PowerShell itself (no eval/command injection, no credential/secret handling, no exfiltration, no backdoor). The primary concern is supply-chain risk: the script runs pip install for third-party packages and creates a helper that later runs npm ci/npx tsc/node build/main.js—both can execute arbitrary third-party install/build scripts. Additionally, it installs a component described as bypassing YouTube bot verification, which is behaviorally suspicious but not proof of malware. Treat as moderate supply-chain risk and review/pin dependency versions and inspect the installed packages before use.

No direct malware behavior (exfiltration, backdoor, reverse shell, or credential theft) is visible in this installer fragment. The primary security concern is supply-chain risk: it installs multiple third-party Python packages via pip without pinning or integrity verification, and it deploys the entire repository contents into a live Skill directory. Additionally, the script’s optional “PO Token Provider” is explicitly framed as bypassing YouTube verification, which warrants additional scrutiny of that dependency’s provenance and behavior.

SUSPICIOUS: the core media-processing behavior is coherent and mostly benign, but the recommended installation path is inconsistent and involves transitive skill installation from an unverified GitHub target, plus remote installer patterns (`curl|bash`). No strong evidence of credential theft or malicious exfiltration was found.