yt-dlp-downloader

Fail

Audited by Socket on Mar 8, 2026

1 alert found:

Obfuscated File
Obfuscated FileHIGH
SKILL.md

The skill is largely coherent with its stated purpose as a local video-downloading helper using yt-dlp, including optional login via cookies and proxy. The main concerns are: (1) the hardcoded output directory tied to a specific user environment, which reduces portability; (2) potential exposure of sensitive browser cookies when using --cookies-from-browser, especially if logs or intermediaries capture cookie data; (3) minimal error handling guidance in the provided snippets. Overall, it is benign in intent and scoped to download tasks, but the presence of credential-related data flow (cookies) and a fixed local path elevate risk slightly to a suspicious-but-not-malicious level.

Confidence: 98%
Audit Metadata
Analyzed At
Mar 8, 2026, 11:01 AM
Package URL
pkg:socket/skills-sh/Rabbit-Ivan%2FIvan-skills%2Fyt-dlp-downloader%2F@0e4409ccc298ca5cca58d6fe68db987c62f92afd