Security checks across malware telemetry and agentic risk
This YouTube downloader appears to do what it says, but its scripts run user-influenced shell commands in unsafe ways that deserve review before installation.
Install only if you are comfortable running local downloader scripts that execute shell commands, install yt-dlp from pip, write to your media folders, and overwrite predictable output files. Do not pass untrusted URLs, filenames, or output directories. A safer version would remove shell=True and os.system, validate output names and paths, avoid reusing another skill's virtual environment, and pin or separately approve package installation.
def run_command(cmd, cwd=None, capture=True):
"""执行shell命令"""
print(f"🔧 执行: {cmd}")
result = subprocess.run(cmd, shell=True, cwd=cwd, capture_output=capture, text=True)
if result.returncode != 0:
print(f"❌ 命令执行失败: {cmd}")
if result.stderr:print(f"\n✅ 完成!")
print(f"📁 输出文件: {output_file}")
os.system(f'ls -lh "{output_file}"')
if __name__ == "__main__":
main()66/66 vendors flagged this skill as clean.