Video Downloader

• Analyzed: May 11, 2026, 4:55 AM
• Findings: 1
• Version: 1.0.0
• Hash: 740138e5ede29409b1ca17d03f48a071831b7c964c6465e98245507c75fb4b53
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for downloading videos using `yt-dlp`, a legitimate tool. The `download_video.py` script uses `subprocess.run` with a list of arguments, which is the safest method to execute external commands, mitigating shell injection risks. Crucially, `SKILL.md` provides explicit security instructions to the AI agent, such as 'Keep downloads in a user-approved directory and never write outside it' and 'Never store account credentials or private tokens,' demonstrating a clear intent to prevent misuse. While `yt-dlp` is a powerful tool and the script writes to user-specified paths, these actions are aligned with the stated purpose and are accompanied by strong guardrails for the agent, indicating a benign design.