YouTube Transcript Native Node

• Analyzed: May 14, 2026, 4:26 PM
• Findings: 1
• Version: 1.0.2
• Hash: f5d9f3e5374f1bdc5a6746d0ba697aca3111a636859d39c3542e00002f0ee76b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a well-implemented YouTube transcript fetcher that wraps the `yt-dlp` binary using native Node.js. It includes several security hardening measures in `scripts/fetch.mjs`, such as strict YouTube URL host allowlisting, regex-based language code validation, shell-less subprocess spawning with a 120-second timeout, and a 2-million-character output limit to prevent resource exhaustion. The code is transparent, lacks external npm dependencies, and contains no indicators of data exfiltration or malicious intent.