Video Fetch — YouTube & Bilibili

• Risk level: Low
• Analyzed: Mar 8, 2026, 5:27 AM
• Findings: 0
• Version: 3.2.0

Overview

The skill's code and runtime instructions match its stated purpose (fetching/transcribing YouTube & Bilibili videos) and the requested secrets (ElevenLabs API key, Bilibili cookie) are proportionate to that purpose, though the registry metadata omits declaring those optional credentials.

This skill appears to do what it says: download transcripts/audio and transcribe videos. Before installing, consider: (1) You may need to provide an ElevenLabs API key if you want cloud STT—this will send audio to ElevenLabs (privacy implication); if you prefer local processing, install Whisper and ffmpeg. (2) For Bilibili AI subtitles you must supply your browser cookie file (~/.bilibili_cookie); treat that cookie like a password and keep file permissions tight. (3) The skill recommends residential proxies for YouTube — only use proxies you control/trust and route only necessary domains. (4) The registry metadata doesn't list the optional ELEVENLABS key or cookie, so double-check you understand which secrets you provide and how (use @filepath rather than inline env variables). (5) If you have sensitive data in videos, prefer local Whisper rather than cloud STT. If you want higher assurance, inspect the full script (scripts/youtube_fetch.py) to confirm there are no unexpected network endpoints beyond YouTube/Bilibili/ElevenLabs and to verify behavior for your threat model.