{
  "$schema": "https://bestaiskill.com/schemas/agent-install/2.json",
  "skill": "youtube-downloader",
  "built": "2026-10-26",
  "control_level": 5,
  "control_level_label": "L5 严管",
  "capabilities": [
    "credential",
    "execute_command",
    "install_deps",
    "network",
    "write_file"
  ],
  "required_controls": {
    "agent": [
      "isolated_environment",
      "per_use_authorization"
    ],
    "admin": [
      "strict_authorization",
      "full_audit",
      "compliance_signoff"
    ]
  },
  "evidence": [
    {
      "file": "本地凭据 / 浏览器配置",
      "summary": "Reading user login cookies/sessions/keyrings: Browser cookies: --cookies-from-browser chrome/firefox → yt-dlp reads browser cookie stores (script"
    },
    {
      "file": "scripts/",
      "summary": "Executing local scripts or commands: External CLIs: yt-dlp (downloading/metadata/format listing), ffprobe/ffmpeg, docker run/start/rm/info, pip inst"
    },
    {
      "file": "scripts/ 或 SKILL.md",
      "summary": "Declares dynamic installation of external language package dependencies"
    },
    {
      "file": "网络端点",
      "summary": "Declares external network access: youtube.com: yt-dlp metadata/stream fetching; oEmbed fallback via urlopen https://www.youtube.com/oembed ("
    },
    {
      "file": "本地工作目录",
      "summary": "File I/O and artifact output: Download output: recursive mkdir for output_dir + writing video/audio/subtitle files per -o templates (templates support absolute paths and yt-dlp %()s syntax, user configurable"
    }
  ],
  "verification": {
    "method": "第二遍独立复核：换角度重读 4 个文件全文（SKILL.md 509 行、download_video.py 1088 行、两 references、.security-scan-passed），逐项反查网络调用点/凭证路径/隐藏脚本，并做引用原文子串级校验（24 条 quote 全部命中原文）。全程静态取证，未运行任何下载/pip/docker 动作；只对 pin 的 commit 63a65c1fccae9f32f7d1e0e99670321ae09d4f53 下结论。",
    "second_pass": [
      {
        "item": "yt-dlp 调用真实存在（下载/-F/-o/-f/--dump-json）",
        "status": "ok",
        "detail": "脚本 cmd = [\"yt-dlp\"] 起步（738 行），全部参数列表化"
      },
      {
        "item": "ffmpeg/ffprobe 调用",
        "status": "ok",
        "detail": "SKILL.md 多处 ffmpeg 命令 + 脚本 get_video_resolution 中 which ffprobe 实测存在"
      },
      {
        "item": "cookie 读取路径（--cookies-from-browser / --cookies）",
        "status": "ok",
        "detail": "773-776 行真实拼接；注意解密主体是 yt-dlp 而非脚本，脚本无 cookie 解析代码"
      },
      {
        "item": "cookie 日志脱敏 filter_cookie_lines",
        "status": "ok",
        "detail": "仅过滤含 'extracting cookies' 或 'extracted'+'cookies' 的行，非完整脱敏（其他含 cookie 内容行仍会输出）——实现与声称基本一致，范围略窄"
      },
      {
        "item": "oEmbed 兜底网络端点",
        "status": "ok",
        "detail": "660-663 行 urlopen youtube.com/oembed，URL 经 quote 编码，无注入面"
      },
      {
        "item": "PO token：docker bgutil 容器 + 4416 ping 探活",
        "status": "ok",
        "detail": "437-446/553-563 行 docker run brainicism 镜像，255-257 行 ping；容器内实现本 repo 无法审计 → 供应链项如实标注"
      },
      {
        "item": "WPC 浏览器回退自动拉起 Chrome",
        "status": "ok",
        "detail": "脚本只传 --extractor-args youtubepot-wpc:browser_path=…（249-252 行）+ find_chrome_path；真实浏览器启动由第三方插件 yt-dlp-getpot-wpc 完成，脚本侧证据到传参为止"
      },
      {
        "item": "pip 自动安装插件（清华镜像）",
        "status": "ok",
        "detail": "350、377 行安装命令真实存在，PYPI_MIRROR 38 行硬编码"
      },
      {
        "item": "代理读取与容器透传（含 host.docker.internal 改写、代理凭证注入）",
        "status": "ok",
        "detail": "get_proxy_settings 读 env 代理；normalize_proxy_for_docker 保留 username/password 注入容器 env"
      },
      {
        "item": "隐藏脚本/混淆/动态执行",
        "status": "ok",
        "detail": "目录仅 1 个 .py；grep 证实 0 处 shell=True、无 eval/os.system/requests；无其他网络库"
      },
      {
        "item": "声明与代码相符性（'up to 4K' / 'HLS with auth headers' / 自动回退）",
        "status": "ok",
        "detail": "'4K' 依赖外部 PO token provider（SKILL 质量表自注），条件性成立；'Docker 缺失不装而是切 WPC' 与脚本 ensure_po_token_provider 分支一致"
      },
      {
        "item": "文件写出面（输出目录/模板/容器）",
        "status": "ok",
        "detail": "mkdir + -o 模板落盘；模板接受绝对路径（build_output_template），任意写位置面存在但属 agent 可控参数"
      }
    ],
    "level": 2,
    "level_label": "V2 已复核",
    "commit": "63a65c1fccae9f32f7d1e0e99670321ae09d4f53",
    "sha256": "6c6c403e7e905b4e283c2567d4c929682f09ff10cbd605af194a02739b4112df",
    "reviewed_by": "skills-bayx-audit",
    "reviewed_at": "2026-10-25"
  },
  "assessed_at": "2026-10-25",
  "method_version": "2.0",
  "mirror": {
    "archive": "https://skillpub.pages.dev/r2/v/2026-09-06/youtube-downloader.tar.gz",
    "sha256": "6c6c403e7e905b4e283c2567d4c929682f09ff10cbd605af194a02739b4112df",
    "commit": "63a65c1fccae9f32f7d1e0e99670321ae09d4f53"
  },
  "original": {
    "github": "https://github.com/daymade/claude-code-skills/tree/main/youtube-downloader",
    "path": "youtube-downloader",
    "commit": "63a65c1fccae9f32f7d1e0e99670321ae09d4f53"
  }
}