Account Video Downloader

• Outcome: Review
• Latest audit: Aug 9, 2026 · 6:50 AM UTC
• Version: 0.1.0

Overview

This skill does what it says, but it enables bulk watermark-free downloading through a third-party API with weak privacy, permission, and lawful-use guardrails.

Review before installing. Use it only for media you own or are authorized to download, and assume account IDs, profile URLs, target video URLs, and your YIGE API key are sent to yige.zone. Avoid pasting sensitive or private targets, rotate the API key if exposed, and be cautious because full download links may appear in chat output or local logs.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill directs execution of a Python script that reads an API key from environment variables, performs network requests to a third-party service, and writes downloaded media to local storage, yet it declares no permissions or equivalent warning/consent boundary. That mismatch undermines least privilege and informed consent, making it easier for an agent or user to invoke data transfer and local file writes without understanding the scope.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README explicitly promotes bulk downloading of account content to the local machine across multiple platforms, but provides no warning about copyright, consent, privacy, or platform Terms of Service. In this skill context, the stated use cases include competitor analysis, bulk archiving, and material reuse, which increases the likelihood of misuse and unauthorized collection or retention of third-party content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Advertising watermark-free direct links materially increases abuse potential because it facilitates attribution removal and easier reposting of creator content without permission. Given the skill description's emphasis on batch extraction, competitor monitoring, and secondary editing, the lack of any compliance warning makes this more dangerous than a generic downloader README.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly promotes watermark-free extraction and bulk local downloading of content from multiple platforms for reuse, backup, and competitive analysis, but provides no warning about copyright, authorization, or platform terms restrictions. This creates a material compliance and misuse risk by encouraging potentially infringing or unauthorized mass acquisition of third-party media.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The skill instructs users to provide account IDs, profile URLs, and an API key for a third-party service, but does not disclose what account identifiers are transmitted, how they are processed, retained, or shared. This omission increases privacy and security risk because users may unknowingly send target account data and potentially sensitive usage patterns to an external provider without informed consent or handling expectations.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger phrases include broad natural-language prompts such as generic requests to download or extract videos, which can cause accidental invocation outside narrowly intended contexts. In an agent setting, overbroad triggers increase the chance the skill activates on ambiguous user input and initiates third-party requests or downloading behavior the user did not explicitly authorize.

Vague Triggers

Medium

• Confidence: 85% confidence
• Finding: The manifest description advertises many broad trigger terms and high-risk use cases, including bulk downloading and competitor-content extraction, without constraints or safeguards. This increases the chance of unintended routing and also normalizes potentially unauthorized content acquisition behavior in contexts where the user may not own the content.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill instructs users to send platform account identifiers and content links to the yige.zone API but does not provide a privacy warning or meaningful disclosure about third-party processing. Users may unknowingly transmit creator/account data and media URLs to an external service, which is a consent and privacy transparency failure.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The code sends user-supplied Bilibili account URLs and the YIGE API key to an external service, but this file provides no consent, disclosure, minimization, or trust boundary enforcement. That creates a privacy and data-sharing risk because user inputs and credentials are exposed to a third-party API, and the skill context explicitly promotes bulk extraction/downloading of creator content, which increases sensitivity and abuse potential.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The download lookup forwards user-provided video URLs to an external parsing API together with an API key, again without any visible warning, consent, or limitation in this code. Because this skill is specifically designed for large-scale extraction and downloading, the transmission is more dangerous than a normal metadata lookup: it facilitates third-party processing of potentially sensitive user targets and copyrighted content.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code sends user-supplied Douyin account identifiers, optional date filters, and a tracking/source string to a third-party API service. In this file there is no user-facing notice, consent flow, or minimization of transmitted data, so users may unknowingly disclose account targets and usage metadata to an external provider. Given the skill’s purpose of large-scale account content extraction, this external sharing is materially relevant and not merely incidental.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The downloader submits each work URL to an external parsing API to obtain downloadable media links, again without any visible disclosure in this file. Work URLs can reveal which creator/content a user is targeting, and in this skill context the feature is explicitly aimed at bulk extraction and reuse of creators’ videos, which increases privacy, compliance, and abuse concerns around undisclosed third-party transmission.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The code sends user-supplied YouTube channel identifiers to a third-party API together with an API key, but this file provides no consent prompt, privacy notice, or minimization of transmitted data. This creates a real data-handling and trust-boundary issue because users may not realize their inputs are being relayed to an external service, and the external service gains both the query data and credentialed access context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The download-info path forwards user-provided video URLs to an external API and includes the API key in the request headers without any visible warning in this code. That is a genuine privacy and security concern because arbitrary user-submitted URLs are disclosed to a third party, and the operation depends on sensitive credentials that may broaden the consequences of misuse or compromise.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The output rules require the agent to always display complete downloadable resource links and forbid omitting any returned data, which creates a direct data-exposure channel in natural-language responses. If the upstream API returns signed URLs, temporary tokens, tracking parameters, or other sensitive resource locators, the agent is instructed to reveal them verbatim to the user or chat transcript.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The Markdown output path explicitly requires showing complete resource download links and forbids omission or summarization, which can expose signed CDN URLs, private media endpoints, or other sensitive user/resource URLs in full. In this skill context, the feature is specifically designed to extract and distribute downloadable media links across multiple platforms, making accidental leakage and downstream misuse more likely.

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

• Confidence: 90% confidence
• Finding: requests.post(url, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "download_url": None, "title": None, "cover": None,

• Confidence: 91% confidence
• Finding: requests.post(url, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            result = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "account": None, "works": [], "error": "请求超时，请稍后重试"}

• Confidence: 84% confidence
• Finding: requests.post(url, json=

External Transmission

Medium

• Category: Data Exfiltration

Content

}

        try:
            resp = requests.post(url, json=payload, headers=headers, timeout=30)
            data = resp.json()
        except requests.exceptions.Timeout:
            return {"success": False, "download_url": None, "title": None, "cover": None,

• Confidence: 86% confidence
• Finding: requests.post(url, json=

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.