advanced-video-downloader
Fail
Audited by Snyk on Feb 15, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 1.00). The prompt includes explicit examples and command templates that embed API keys and tokens verbatim (e.g., --api-key sk-xxx, SILICONFLOW_API_KEY=sk-xxx, echo $SILICONFLOW_API_KEY), which requires the agent to handle/output secret values directly.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 1.00). The skill explicitly downloads and transcribes user-provided public videos from open platforms (YouTube, Bilibili, TikTok, Twitter, Instagram, etc.) using yt-dlp (see SKILL.md “Core Capabilities” / download commands and "Combined Workflow") and then runs the bundled transcription script (scripts/transcribe_siliconflow.py), so the agent ingests untrusted, user-generated third‑party content as part of its workflow.
Audit Metadata