vsum

This skill appears to do what it says (download subtitles with yt-dlp and summarize them with an AI), but there are privacy and transparency gaps you should consider before installing: - You must have yt-dlp installed separately; the skill metadata doesn't state that as a required binary. - For Bilibili it uses yt-dlp's --cookies-from-browser option, which reads your browser's cookies (session tokens). That can expose sensitive session data; only run this if you trust the environment and understand the cookie access. - The SKILL.md mentions using external AI providers but does not declare how API keys are provided. Expect to supply an API key/credential to the agent; ensure you use a trusted provider and understand that subtitle text will be transmitted to that provider. - The helper script writes subtitle files to ~/Downloads; check that location if you are concerned about local storage or accidental disclosure. - If you need stronger guarantees, ask the author to: (1) add yt-dlp and required API credentials to the skill metadata, (2) document exactly where summaries are sent and how credentials are stored/used, and (3) avoid or clearly warn about reading browser cookies (or provide alternate auth flows).