Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward yt-dlp download helper whose file writes and network use match its stated purpose.
Before installing, understand that using this skill will run yt-dlp against user-provided video links and create downloaded files in ~/Movies by default. Confirm the destination, avoid unintended playlist downloads, and do not provide site cookies or account credentials unless you understand the privacy implications.
Hard-coding --sub-lang zh-Hans assumes a subtitle language preference without clear user opt-in. While not directly dangerous like code execution, it can cause unintended downloads, unexpected behavior, and privacy or UX issues if the agent fetches additional data the user did not request.
The skill defaults to writing downloaded content into the user's filesystem (~/Movies) but does not clearly warn users that triggering the skill will create files locally. In an agent context, silent file creation can surprise users, consume storage, and increase risk when large or repeated downloads occur without explicit confirmation.
No suspicious patterns detected.
