Bilibili & YouTube Watcher
Analysis
The skill does what it claims—fetches video subtitles via yt-dlp—but users should notice the external downloader installation and optional browser-cookie troubleshooting advice.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
result = subprocess.run(cmd, cwd=temp_dir, check=True, capture_output=True)
The script runs the external yt-dlp tool against the supplied video URL. This is central to the transcript-fetching purpose and uses an argument list rather than a shell, so it is a purpose-aligned note rather than a concern.
sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
The README documents an optional Linux install method that downloads the latest yt-dlp binary directly and writes it with sudo privileges. yt-dlp is expected for this skill, but this install route has more supply-chain exposure than a pinned package manager install.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Use cookies: `yt-dlp --cookies-from-browser chrome "URL"`
The README suggests an optional troubleshooting command that would allow yt-dlp to read browser cookies. This can be legitimate for accessing videos, but browser cookies are sensitive session data and this is not part of the main script or declared credential requirements.