video-downloader

该 skill 的用途与大多数能力基本匹配，未见明显凭据中转到攻击者域名或隐蔽外传指令，因此不像确认恶意内容。但其实际信任面较大：依赖个人 GitHub 的 douyin-downloader、第三方 wx_channels_download 本地二进制/API、可变分支更新，以及对 Cookie/配置文件的读写，都使其整体应判为可疑偏高风险而非良性低风险。

Based on the provided fragment, there is no direct evidence of classic malware behaviors (reverse shell, eval-based payload execution, obvious data exfiltration, or destructive filesystem operations). However, the tool performs high-sensitivity credential/cookie automation via Playwright and manages/stores authentication tokens in local YAML config. Additionally, the presence of a hardcoded external repo reference and command execution via `uv run python run.py` indicates supply-chain/installation risk that must be audited in the surrounding code (not included here). Overall: suspicious mainly for credential-handling and potential supply-chain execution; malware confidence is low-moderate due to incomplete context.