Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward reference-video search workflow with disclosed browsing and optional local download behavior.
Before installing, understand that this skill will browse video-reference sites and may download selected YouTube or Vimeo videos to ~/Downloads. Only download content you have rights to store, and monitor file sizes.
The natural-language description and invocation instructions are written entirely in Chinese and specify a Chinese trigger phrase, implying a fixed language expectation. There is no indication that the user may choose another language or that the Chinese-only behavior is justified by a region-specific requirement.
The invocation trigger is very broad: any request like finding a reference clip for a topic can activate a workflow that performs web browsing, link extraction, and potentially downloading files. Overly permissive triggering increases the chance of unintended activation and can lead the agent to take networked and file-writing actions without sufficiently explicit user consent for each stage.
The skill instructs the agent to download videos directly to ~/Downloads/ using yt-dlp, but it does not present a prominent upfront warning that local files will be created. This creates a filesystem-impact risk: users may not realize the skill can write potentially large media files locally, which can cause unwanted persistence, storage consumption, or accidental handling of copyrighted/sensitive content.
No suspicious patterns detected.
