youtube-downloader

Warn

Audited by Runlayer on Feb 21, 2026

Risk Level: MEDIUM
Scan Summary
Max Score
78%
Files
4
Flagged
4
Chunks
9
Flagged Files (4)
.security-scan-passedHIGH
78.3%

Malicious tool definition detected

Tool: .security-scan-passed Description: Security scan passed

SKILL.mdHIGH
78.3%

Malicious tool definition detected

Tool: SKILL.md [1/3] Description: --- name: youtube-downloader description: Download YouTube videos and HLS streams (m3u8) from platforms like Mux, Vimeo, etc. using yt-dlp and ffmpeg. Use this skill when users request downloading videos, extracting audio, handling protected streams with authentication headers, or troubleshooting download issues like nsig extraction failures, 403 errors, or cookie extraction problems. --- # YouTube Downloader ## Overview Enable reliable video and audio downloads

Tool: SKILL.md [2/3] Description: Need to convert downloaded WebM videos to MP4 format for wider compatibility - Request downloading HLS streams (m3u8) from platforms like Mux, Vimeo, or other streaming services - Need to download protected streams that require authentication headers ## Prerequisites ### 1. Verify yt-dlp Installation (Run this yourself) ```bash which yt-dlp yt-dlp --version ``` If not installed or outdated (< 2025.10.22): ```bash brew upgrade yt-dlp # macOS # or pip install --up

Tool: SKILL.md [3/3] Description: - `--merge-format` - Merge output container (e.g., mp4, mkv).

references/po-token-setup.mdHIGH
78.3%

Malicious tool definition detected

Tool: references/po-token-setup.md Description: # PO Token Setup Guide ## What are PO Tokens? Proof of Origin (PO) Tokens are cryptographic attestations required by YouTube for certain clients and request types. Without them, requests for affected format URLs may return HTTP Error 403 or result in restricted format access. ## Why PO Tokens Matter As of late 2024/early 2025, YouTube increasingly requires PO tokens for high-quality video formats (1080p, 1440p, 4K).

scripts/download_video.pyHIGH
78.3%

Malicious tool definition detected

Tool: scripts/download_video.py [1/4] Description: #!/usr/bin/env python3 """ YouTube video downloader using yt-dlp with robust error handling.

Tool: scripts/download_video.py [2/4] Description: check.returncode == 0: return True print("⚠️ Installing PO Token provider plugin (one-time setup)...") install_cmd = [python_bin, "-m", "pip", "install", "bgutil-ytdlp-pot-provider", "-i", PYPI_MIRROR] if proxy_url: install_cmd.extend(["--proxy", proxy_url]) install = subprocess.run(install_cmd, capture_output=True, text=True) return install.returncode == 0 def ensure_wpc_provider(proxy_url: Optional[str]) -> bool: version = parse_yt_dlp_version

Tool: scripts/download_video.py [3/4] Description: Use Android client to avoid nsig extraction issues audio_only: Download audio only list_formats: List available formats instead of downloading info_only: Print video info before exiting Returns: Exit code (0 for success, non-zero for failure) """ # Check if yt-dlp is installed check_result = subprocess.run( ["which", "yt-dlp"], capture_output=True, text=True ) if check_result.returncode != 0: print("✗ Error: yt-dlp is not installed") print(" Ins

Tool: scripts/download_video.py [4/4]

Audit Metadata
Max File Score
78%
Classification
UNKNOWN_SERVER
Files Scanned
4
Files Flagged
4
Chunks Analyzed
9
Analyzed
Feb 21, 2026, 09:20 AM
Security Audit — runlayer — youtube-downloader