Video Transcript Downloader

• Analyzed: May 13, 2026, 3:00 AM
• Findings: 1
• Version: 1.0.0
• Hash: 5cef54b9c1e850dd77ca6b59fdc739db3bba3dc7d2856488efa0333953aa7f4f
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to its use of `node:child_process.spawn` to execute external binaries (`yt-dlp`, `ffmpeg`) and, critically, its explicit forwarding of arbitrary user-supplied arguments (`opts.extra`) directly to `yt-dlp` in `scripts/vtd.js`. This passthrough mechanism, documented in `SKILL.md`, allows for command injection into `yt-dlp`'s powerful `--exec` option, which could lead to arbitrary code execution if the AI agent is prompted to pass malicious arguments. While this capability is plausibly needed for advanced `yt-dlp` usage, it significantly increases the attack surface for prompt injection against the agent, making it a risky capability without clear malicious intent from the skill itself.