Is Chubbyskills safe to use?

Chubbyskills has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install Chubbyskills?

Chubbyskills supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with Chubbyskills?

Chubbyskills is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is Chubbyskills actively maintained?

Chubbyskills is actively maintained — last commit was 14 days ago. It has 473 GitHub stars.

Chubbyskills

Name: Chubbyskills
Author: chubbyguan

yt-dlp · by chubbyguan

把中文全渠道内容（抖音 / B站 / 小红书 / 公众号 / X / 播客）采集进个人知识库的 13 个 AI Skill：图文存图、视频转文字稿、字幕优先免 GPU，附带知识库 MCP server。｜ Ingest Chinese content into your personal knowledge base — image/video routing, subtitle-first transcription, and a KB MCP server.

473 GitHub PyPI

No known CVEs

MIT license

Actively maintained

Last commit 14d ago

Works with most clients

Transport: stdio

0 tools

Grade F

Edit this pageView history

AI / ML Education

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "chubbyskills": {
      "args": [
        "yt-dlp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/chubbyskills)](https://mcppedia.org/s/chubbyskills)

Read me

What Chubbyskills does

平时做内容、搭个人知识库，也写一些 AI Agent / Skill 的实践。我习惯把每天刷到的好东西——视频、播客、公众号、小红书、推特——自动收进自己的知识库，让信息真正沉淀下来，而不是看完就忘。这个仓库里的工具，就是这套工作流里我自己每天在用的那几件。

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'yt-dlp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

60/100across 5 weighted dimensions

How we score →

0255075100

−40

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

11 fixed

GHSA-69qj-pvh9-c5wghigh · fixedCVSS 7.5

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

### Summary yt-dlp's `--exec` option is vulnerable to arbitrary command injection when handling untrusted metadata if the argument uses standard string formatting (e.g. `%(title)s`) or other unsafe conversions. An attacker could achieve remote code execution on the user's machine via maliciously crafted metadata containing quotes or other special shell characters. ### Details Since yt-dlp version 2021.04.11, the `--exec` option has supported "output template syntax", which is a superset of Pyth

Affected: >= 2021.4.11Fixed in 2026.6.9source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. ### Details When downloading a fragmented manifest format such as an HLS or DASH strea

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

### Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the user's filesystem, bypassing the remediation for `CVE-2024-38519`. ### Details The fix for `CVE-2024-38519` enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as `.exe` or `.sh`) during file downloads. However, this allowlist explicitly included the unsafe extensions `.desktop`, `.ur

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to [GHSA-v8mc-9377-rwjj](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj>) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24. ### Details At the file download st

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

### Summary When yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. ### Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Chubbyskills safe to use?: Chubbyskills has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Chubbyskills?: Chubbyskills supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Chubbyskills?: Chubbyskills is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is Chubbyskills actively maintained?: Chubbyskills is actively maintained — last commit was 14 days ago. It has 473 GitHub stars.

Similar servers

Others in ai-ml / education

View all →

Sequential Thinking MCP Server98

Dynamic problem-solving through sequential thought chains

87.9k 1

Memory MCP Server96

Persistent memory using a knowledge graph

87.9k 5

Gemini Cli95

An open-source AI agent that brings the power of Gemini directly into your terminal.

105.7k 8

Gpt Researcher95

An autonomous agent that conducts deep research on any data using any LLM providers

28.0k 5

MCP Security Weekly

Get CVE alerts and security updates for Chubbyskills and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

AI / ML Education

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "chubbyskills": {
      "args": [
        "yt-dlp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/chubbyskills)](https://mcppedia.org/s/chubbyskills)

Read me

What Chubbyskills does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'yt-dlp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

中文 · English

🧰 Chubby Skills

信息流会忘，知识库会记 —— 把全渠道好内容采集进你的第二大脑

我是 Chubby，Ai+电商的探索者

同好的话，欢迎来唠：

🐦 X / Twitter
💬 即刻
📕 小红书
📰 微信公众号：关关不过

都是在自己项目里跑通了一段时间，确实省事，才搬出来开源的。没什么花活，就是几个挺实用的东西。

这里的每个 Skill 都是 Agent 能直接加载的结构化指令集，遵循 Agent Skills 开放标准。Claude Code、Codex、OpenCode、OpenClaw、Hermes 都能装。

✨ 能帮你做什么

📥 全渠道采集 —— 抖音 / B站 / 小红书 / 公众号 / X / 播客 / YouTube，把链接丢进来就行
🎬 图文 / 视频自动分流 —— 图文笔记存图、视频笔记转成文字稿，不用你操心
⚡ 字幕优先，免 GPU —— YouTube / B站有字幕时秒出文字，不必先装一堆模型
🧠 沉淀进知识库 —— 统一格式入 Obsidian，还带一个 MCP server，让任何 Agent 都能查你的库
🧩 每个 skill 独立可装 —— 只装你需要的那一个，纯图文 / 文字采集零依赖

一句话：把中文全渠道的内容，变成你自己的、可检索的第二大脑。

🚦 当前路线

这个仓库已经从「单个 skill 能跑」推进到「个人内容采集管线」：

v0.2 reliability：安装分档、CI、示例输出、统一 frontmatter 校验、失败提示更清晰
v0.3 workflow：把「识别链接 → 调用 skill → 可选加工 → 入库」串成一个命令
v0.4 platform depth：补 B站/YouTube 批量、公众号结构保真、小红书/X 手动 fallback
v0.5 core pipeline：新增 chubby.yaml、队列、运行状态、失败重试、每日运行报告、schema v1
v0.6 platform health：新增平台定义、站点模板、状态页生成器、平台失败 issue form
v0.7 knowledge vault：新增 vault 模板、SQLite 本地索引、全文检索、recent/read/stats、MCP 检索增强
v0.8 first-run UX：新增 quickstart 首跑验收，离线打通配置、dry-run、schema 校验、平台定义、vault 索引和 MCP 前置检查
v0.9 knowledge automation：新增 semantic-lite 检索、自动归档、知识卡片生成、贡献者平台 scaffold

下一阶段会继续补更完整的真实平台 smoke test、embedding provider 和 MCP 工作流。

🚀 推荐开始方式

1. 跑首轮验收

git clone https://github.com/chubbyguan/chubbyskills.git
cd chubbyskills
python3 tools/chubby.py quickstart

quickstart 不会抓真实平台内容，会离线完成配置初始化、X 链接 dry-run、示例 Markdown 校验、平台定义校验、临时 vault 索引和 MCP 前置检查。完整说明见 docs/quickstart.md。

2. 轻量安装（默认推荐）

bash setup.sh
# 等同于 bash setup.sh light

轻量模式可直接使用：公众号文章、X 图文、小红书图文、行业情报雷达、知识库健康检查、content-enrich。只有视频/播客转录才需要装重依赖。

3. 按需安装重依赖

bash setup.sh video     # 抖音/B站/TikTok/微博/知乎/YouTube/小红书视频/X视频
bash setup.sh podcast   # 播客转录
bash setup.sh wechat    # 公众号/PDF 解析增强
bash setup.sh all       # 全部依赖

4. 个人知识管线（推荐）

# 初始化 chubby.yaml、队列、状态和报告目录
python3 tools/chubby.py init

# 或直接跑 v0.8 首跑验收
python3 tools/chubby.py quickstart

# 单条采集，会写入 .chubby/runs.jsonl 并生成 runs/YYYY-MM-DD.md
python3 tools/chubby.py ingest "https://x.com/user/status/123" --dry-run

# 把链接逐行放进 inbox/links.txt 后批量执行
python3 tools/chubby.py run

# 查看最近状态 / 重试失败项
python3 tools/chubby.py status --latest
python3 tools/chubby.py retry --all-failed

# 查看平台健康度和模板覆盖
python3 tools/platform_health.py --check
python3 tools/platform_health.py --local --check

# 建立本地知识库索引并检索
python3 tools/vault_index.py index ~/Documents/ObsidianVault
python3 tools/vault_index.py search "AI Agent"

5. 轻量单条采集

# 自动识别平台并调用对应 s

... [View full README on GitHub](https://github.com/chubbyguan/chubbyskills#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

60/100across 5 weighted dimensions

How we score →

0255075100

−40

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

11 fixed

GHSA-69qj-pvh9-c5wghigh · fixedCVSS 7.5

yt-dlp: Arbitrary command injection possible if --exec option used with yt-dlp

Affected: >= 2021.4.11Fixed in 2026.6.9source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Chubbyskills safe to use?: Chubbyskills has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Chubbyskills?: Chubbyskills supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Chubbyskills?: Chubbyskills is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is Chubbyskills actively maintained?: Chubbyskills is actively maintained — last commit was 14 days ago. It has 473 GitHub stars.