ytdlp-transcript — YouTube to Text via yt-dlp

• Analyzed: May 11, 2026, 6:57 AM
• Findings: 1
• Version: 1.0.0
• Hash: da40ae6c5222269d003d7105e64cf80413de2b332734d0b41011a134dec9dced
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is a functional utility designed to fetch and clean YouTube transcripts using the `yt-dlp` command-line tool. The core logic in `transcript.js` includes strict regex validation for YouTube video IDs and uses `spawnSync` to execute commands safely without shell interpolation. While there is a discrepancy between the dependencies listed in `package.json` and the more extensive `package-lock.json`, the script itself does not utilize these extra libraries, and no evidence of malicious intent, data exfiltration, or harmful instructions was found.