video-downloader

Warn

Audited by Gen Agent Trust Hub on Mar 11, 2026

Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONCREDENTIALS_UNSAFE
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The file scripts/download.py includes a check_and_install_yt_dlp function that automatically executes pip install yt-dlp during runtime if the package is not detected. This occurs without a separate confirmation step during the download process.\n- [COMMAND_EXECUTION]: The skill invokes external command-line utilities including yt-dlp, ffmpeg, and playwright via the subprocess module. User-provided video URLs are passed as arguments to these external processes.\n- [CREDENTIALS_UNSAFE]: The skill manages Douyin authentication via the scripts/douyin_cookie_extractor.py script. This tool captures sensitive session cookies (including sessionid) and writes them in plain text to predictable files in the user's home directory (~/Downloads/douyin_cookies_simple.txt and ~/Downloads/douyin.com_cookies.txt), which could be accessed by other local applications or users.
Audit Metadata
Risk Level
MEDIUM
Analyzed
Mar 11, 2026, 02:16 PM