video-downloader-enhanced

• Outcome: Review
• Latest audit: Aug 2, 2026 · 4:15 AM UTC
• Version: 0.1.0

Overview

The skill does what it says, but it can automatically use local Chrome browser cookies and a cloud transcription service in ways users should review before installing.

Install only if you are comfortable with the agent running local download/transcription commands and potentially using your Chrome login cookies for supported platforms. Prefer running with ASR disabled or local ASR, set VIDEO_DOWNLOADER_REMOTE=1 for unattended use, and require an explicit user approval step before any cookie-backed download or SiliconFlow upload.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (20)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill documentation describes use of environment variables, local file read/write, network access, and shell execution, but no explicit permission declaration or user-facing capability disclosure is present. This creates a real governance and trust problem because the skill can download remote content, invoke local tools, and write artifacts without a clearly declared permission model.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The provider falls back to `--cookies-from-browser chrome`, which causes yt-dlp to read authenticated browser cookies from the local Chrome profile. That expands the skill from public video retrieval into access using the operator's logged-in session, which is not disclosed in the stated skill purpose and may expose private/subscriber-only content or sensitive account context.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The download path also silently retries with Chrome browser cookies, again using the local browser's authenticated state to fetch content. In a downloader skill, this is especially risky because it can turn a simple archive action into collection of gated or account-specific media without transparent consent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The yt-dlp fallback attempts to read cookies directly from the local Chrome profile via --cookies-from-browser chrome. Accessing browser cookies materially expands the skill from media downloading into local credential/session data access, which is highly sensitive and unnecessary for many downloads; in an agent context this can expose authenticated sessions without meaningful user awareness.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The download fallback repeats the same browser-cookie access during video retrieval, again using the local Chrome cookie store. This broadens the provider's privilege from public video download to potentially harvesting authenticated session material, and because it is embedded in fallback logic it may occur automatically when the primary path fails.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The fallback logic escalates from public retrieval to reading local Chrome browser cookies to access content, which exceeds the expected scope of a downloader unless the user has explicitly consented. In an agent skill context, local browser-cookie access is sensitive because it can expose authenticated session material and create a path to downloading private or account-scoped content.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The module docstring describes a generic fallback order but does not plainly disclose that the final fallback reads Chrome browser cookies from the local system. That omission increases the chance that operators or reviewers underestimate the sensitivity of the behavior and deploy it in contexts where credential access is unacceptable.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The provider falls back to --cookies-from-browser chrome, which causes yt-dlp to read locally stored browser cookies and use authenticated session data for requests. That expands the skill from public downloading into access via user credentials without clear consent, increasing risk of privacy violations, unintended authenticated scraping, and misuse of sensitive session material.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The use of --remote-components ejs:github enables yt-dlp to fetch remote components from GitHub at runtime, introducing dynamic external code/content retrieval not necessary for a simple downloader. This increases supply-chain and integrity risk because behavior can change based on remote resources outside the reviewed codebase.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The SiliconFlow ASR option sends extracted audio to a third-party cloud service, but the skill text does not provide a clear user-facing privacy warning that potentially sensitive spoken content leaves the local machine. In a video archival/transcription workflow, this can expose personal, proprietary, or regulated audio content to an external processor without informed consent.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: When the siliconflow backend is selected, the code uploads extracted audio to a third-party service, which can expose sensitive speech content, personal data, or confidential material. In a video-downloader skill that may process arbitrary user-provided links, this creates a meaningful privacy and data-governance risk if users are not clearly informed and given control over local versus remote transcription.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: This file contains no user-facing notice that the fallback may read browser cookies from Chrome. In an agent skill, undisclosed access to local browser state is dangerous because users may believe they are only downloading public media while the tool accesses sensitive local authentication artifacts.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code automatically attempts Chrome-cookie access after two download failures without any user-facing warning, confirmation, or policy check. Silent escalation to local credential material is dangerous in agent-driven environments because the user may believe they requested a simple public download while the skill accesses private browser state.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Accessing Chrome browser cookies without any user-facing warning or confirmation is a security/privacy issue because it silently leverages existing authenticated sessions. In the context of a video downloader skill, this is more dangerous because users would reasonably expect URL fetching, not credential-backed browser data access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The download path also falls back to browser cookies silently, meaning actual media retrieval may occur under the user's authenticated account without informed consent. This can expose private or age-restricted content access patterns and violate least surprise and least privilege principles.

External Transmission

Medium

• Category: Data Exfiltration

Content

### SiliconFlow (`--asr siliconflow`)

Requires `SILICONFLOW_API_KEY`. Calls `https://api.siliconflow.cn/v1/audio/transcriptions`.

Output artifacts:
- `audio.mp3`

• Confidence: 88% confidence
• Finding: https://api.siliconflow.cn/

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

yt_dlp = _require_ytdlp()
    commands = [
        [yt_dlp, "--no-playlist", "--dump-single-json", url],
        [yt_dlp, "--cookies-from-browser", "chrome", "--no-playlist", "--dump-single-json", url],
    ]
    return json.loads(_run_first_successful(commands))

• Confidence: 97% confidence
• Finding: cookies-from-browser", "chrome

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

yt_dlp = _require_ytdlp()
    commands = [
        [yt_dlp, "--no-playlist", "--dump-single-json", url],
        [yt_dlp, "--cookies-from-browser", "chrome", "--no-playlist", "--dump-single-json", url],
    ]
    return json.loads(_run_first_successful(commands))

• Confidence: 99% confidence
• Finding: cookies-from-browser", "chrome

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

output_path = folder / filename
    command = [
        yt_dlp,
        "--cookies-from-browser", "chrome",
        "--no-playlist",
        "-f", "bv*+ba/b",
        "--merge-output-format", "mp4",

• Confidence: 98% confidence
• Finding: cookies-from-browser", "chrome

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

_base_ytdlp_command() + ["--dump-single-json", url],
        _base_ytdlp_command() + ["--remote-components", "ejs:github", "--dump-single-json", url],
        _base_ytdlp_command()
        + ["--cookies-from-browser", "chrome", "--dump-single-json", url],
    ]
    return json.loads(_run_first_successful(commands))

• Confidence: 87% confidence
• Finding: cookies-from-browser", "chrome; cookies-from-browser", "chrome

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.