youtube-downloader

SUSPICIOUS: The stated purpose and visible capabilities mostly align with a YouTube downloader, and yt-dlp itself is an official, well-known dependency. The main risk is install trust: the skill says it auto-installs yt-dlp but does not reveal how, from where, or with what verification, and the referenced script is missing, so the actual execution and data flows cannot be fully validated.

No definitive malicious activity is present in the wrapper code itself (no stealth, no credential/data theft, no exfiltration logic). The primary security concern is operational and supply-chain risk: the program may download and install `yt-dlp` at runtime via `pip install --break-system-packages`, then executes it with an unvalidated user-provided `url` and a user-influenced output template that leads to filesystem writes. This should be treated as a security-sensitive downloader wrapper rather than trusted application logic. Pin yt-dlp versions, avoid runtime installs in production, and restrict/validate allowed URL schemes/hosts as appropriate for the threat model.