Video Notes

• Outcome: Review
• Latest audit: May 28, 2026 · 9:02 AM UTC
• Version: 1.1.0

Overview

This video-note skill largely does what it says, but it needs review because it can use browser login cookies and can modify the Python environment while running.

Review before installing. Prefer using a preinstalled, pinned yt-dlp in an isolated environment; avoid --cookies-from-browser unless necessary; use a narrowly scoped cookie file where possible; delete /tmp/yt-cookies-export.txt and generated note artifacts when finished; and treat generated local HTML as containing video-derived content and transcripts.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        import yt_dlp  # noqa
    except ImportError:
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "yt-dlp", "-q", "--break-system-packages"],
            stderr=subprocess.DEVNULL,
        )

• Confidence: 95% confidence
• Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "yt-dlp", "-q", "--break-system-packages"], stderr=subprocess.DEVNULL, )

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

# First export cookies to a file so we don't re-authenticate per attempt
    if cookies_browser and not cookies_file:
        cookies_file = "/tmp/yt-cookies-export.txt"
        subprocess.run(
            [sys.executable, "-m", "yt_dlp",
             "--cookies-from-browser", cookies_browser,
             "--cookies", cookies_file,

• Confidence: 97% confidence
• Finding: subprocess.run( [sys.executable, "-m", "yt_dlp", "--cookies-from-browser", cookies_browser, "--cookies", cookies_file, "--skip-download", "-o

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
        import yt_dlp  # noqa
    except ImportError:
        subprocess.check_call(
            [sys.executable, "-m", "pip", "install", "yt-dlp", "-q", "--break-system-packages"],
            stderr=subprocess.DEVNULL
        )

• Confidence: 94% confidence
• Finding: subprocess.check_call( [sys.executable, "-m", "pip", "install", "yt-dlp", "-q", "--break-system-packages"], stderr=subprocess.DEVNULL )

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill's purpose is frame capture from online videos, but the script silently installs yt-dlp at runtime if it is missing. That behavior is risky in automation environments because it performs uncontrolled dependency acquisition and environment mutation during task execution rather than through a reviewed provisioning step.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill performs package-management behavior at runtime by installing yt-dlp if missing, which exceeds the narrowly expected behavior of a note-taking/subtitle extractor. This is dangerous because it downloads and executes external code on the host system without a separate installation step or clear trust boundary.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: Exporting browser cookies to disk introduces credential extraction and storage behavior that is significantly more sensitive than subtitle parsing. In this skill context, that is especially dangerous because users may not expect a video-notes tool to copy authentication material from their browser into a file.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README states the skill will extract subtitles, capture screenshots, and generate a self-contained HTML document, but it does not clearly disclose that video-derived content may be downloaded, processed, and stored locally. This can surprise users with local persistence of potentially copyrighted or sensitive media/transcript data, especially in enterprise or shared-device environments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill instructs use of --cookies-from-browser and cookie files to access authenticated content, but it does not warn users that browser cookies are sensitive credentials that may grant account access. This is dangerous because the workflow normalizes credential extraction and reuse in a general-purpose automation context, increasing the risk of accidental exposure, over-collection, or misuse.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: The workflow writes subtitles, keyframes, and final notes to /tmp and then instructs automatically opening the generated HTML, but the description does not clearly warn about local artifact creation. This can expose potentially sensitive viewing history, transcript content, or generated summaries to other local users, backup processes, or later unintended disclosure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The script handles browser credentials without an explicit warning at the point of use and stores them in a fixed /tmp file. The combination of silent credential export and insecure temporary storage raises the risk of accidental disclosure and violates the principle of least surprise for a note-taking skill.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

**脚本内置降级策略（自动执行，无需手动干预）：**

1. **快速路径**：`--skip-download` 直接获取字幕（速度最快）
2. **降级路径**：若快速路径失败，自动导出 cookies 后用 `-f sb3`（storyboard 格式，YouTube 始终可用）触发字幕下载，解析 VTT 格式
3. **格式兼容**：优先 VTT（支持内联时间标签），失败则回退 SRT

**哔哩哔哩支持：**

• Confidence: 88% confidence
• Finding: cookies-from-browser chrome; cookies-from-browser chrome

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.