video-downloader
Warn
Audited by Gen Agent Trust Hub on Mar 11, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The file
scripts/download.pyincludes acheck_and_install_yt_dlpfunction that automatically executespip install yt-dlpduring runtime if the package is not detected. This occurs without a separate confirmation step during the download process.\n- [COMMAND_EXECUTION]: The skill invokes external command-line utilities includingyt-dlp,ffmpeg, andplaywrightvia thesubprocessmodule. User-provided video URLs are passed as arguments to these external processes.\n- [CREDENTIALS_UNSAFE]: The skill manages Douyin authentication via thescripts/douyin_cookie_extractor.pyscript. This tool captures sensitive session cookies (includingsessionid) and writes them in plain text to predictable files in the user's home directory (~/Downloads/douyin_cookies_simple.txtand~/Downloads/douyin.com_cookies.txt), which could be accessed by other local applications or users.
Audit Metadata