Security audit

BiliYouTik2Brain

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly coherent for video transcription and knowledge archiving, but it automatically uses browser session cookies and has an advertised privacy mode that is not actually enforced by the main CLI/LLM path.

Review this before installing if you use logged-in browser sessions or process sensitive videos. Disable browser cookie use with the documented environment switches where possible, avoid setting LLM API keys when you need local-only processing, and inspect the install script because it can install packages, use sudo for ffmpeg, and create persistent local knowledge files.

SkillSpector

By NVIDIA

SkillSpector could not complete.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/biliyoutik2brain/core/assessor.py:56

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/biliyoutik2brain/core/plugin_loader.py:72

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: scripts/biliyoutik2brain/core/anti_crawl_middleware.py:38