yt-dlp-downloader
Fail
Audited by Socket on Mar 8, 2026
1 alert found:
Obfuscated FileObfuscated FileSKILL.md
HIGHObfuscated FileHIGH
SKILL.md
The skill is largely coherent with its stated purpose as a local video-downloading helper using yt-dlp, including optional login via cookies and proxy. The main concerns are: (1) the hardcoded output directory tied to a specific user environment, which reduces portability; (2) potential exposure of sensitive browser cookies when using --cookies-from-browser, especially if logs or intermediaries capture cookie data; (3) minimal error handling guidance in the provided snippets. Overall, it is benign in intent and scoped to download tasks, but the presence of credential-related data flow (cookies) and a fixed local path elevate risk slightly to a suspicious-but-not-malicious level.
Confidence: 98%
Audit Metadata