jl-video-downloader

• Analyzed: Apr 3, 2026, 2:26 AM
• Findings: 1
• Version: 1.0.1
• Hash: b8df8db3ff04b07aef9a0d8ad9cd36ad26b6f28ca22402a704c0f780bd483168
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle performs high-risk system modifications, including modifying shell configuration files (~/.bashrc or ~/.zshrc) to source environment variables and using 'curl | sh' to install the 'uv' tool in 'scripts/setup.sh'. Additionally, 'scripts/download.sh' uses 'eval' to execute a constructed command string containing user-supplied URLs and arguments, which creates a shell injection vulnerability. While these actions are documented and support the tool's stated purpose of video downloading and transcription, the use of persistence mechanisms and unsafe execution patterns meets the threshold for a suspicious classification.