Social Downloader

• Analyzed: May 16, 2026, 6:51 PM
• Findings: 1
• Version: 1.0.0
• Hash: 98a4f7803adab212c99329640a2aa941c72ad6308bd1c99312bd4492b9087e1b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides functionality to download and transcribe social media videos using yt-dlp and OpenAI's API. However, it contains a shell injection vulnerability in `scripts/download_best.sh` where the `$URL` parameter is passed directly to a shell command without sanitization. Additionally, `scripts/download_transcribe.py` accesses the user's `OPENAI_API_KEY` to exfiltrate audio data to OpenAI's transcription endpoint; while this aligns with the stated purpose, the use of a non-standard model name ('gpt-4o-mini-transcribe') and manual multipart request construction warrants caution.