Bilili-downloader

• Analyzed: May 12, 2026, 3:34 AM
• Findings: 1
• Version: 1.0.3
• Hash: 6c969c007859df023adc3dad1760bafc642079e289893ca617dc135af27c4de3
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is designed to download Bilibili videos using the `yt-dlp` tool. The `SKILL.md` clearly instructs the AI agent to ask for the video URL, and the `scripts/download_bilibili.py` script uses `subprocess.run` to execute `yt-dlp` with the provided URL and options. There is no evidence of data exfiltration, malicious execution beyond the stated purpose, persistence mechanisms, prompt injection attempts against the agent, or obfuscation. The use of `yt-dlp` is a legitimate and expected behavior for a video downloader skill.