Is Chubbyskills safe to use?

Chubbyskills has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.

How do I install Chubbyskills?

Chubbyskills supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What can Chubbyskills do?

Chubbyskills provides 3 tools: search_vault, read_kb_note, reindex_vault. See the full tools list on the server page for descriptions and parameters.

What AI clients work with Chubbyskills?

Chubbyskills is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.

Is Chubbyskills actively maintained?

Chubbyskills is actively maintained — last commit was 6 days ago. It has 639 GitHub stars.

Chubbyskills

Name: Chubbyskills
Author: chubbyguan

yt-dlp · by chubbyguan

把中文全渠道内容（抖音 / B站 / 小红书 / 公众号 / X / 播客）采集进个人知识库的 13 个 AI Skill：图文存图、视频转文字稿、字幕优先免 GPU，附带知识库 MCP server。｜ Ingest Chinese content into your personal knowledge base — image/video routing, subtitle-first transcription, and a KB MCP server.

639 3 tools GitHub PyPI

No known CVEs

MIT license

Actively maintained

Last commit 6d ago

Works with most clients

Transport: stdio

3 tools · ~69 tok

Grade A · 0.0% of 200K ctx

MCPpedia last refreshed this data 11h ago

This server has been archived and is no longer actively maintained.

Edit this pageView history

Chubbyskills is an MCP server that 把中文全渠道内容（抖音 / B站 / 小红书 / 公众号 / X / 播客）采集进个人知识库的 13 个 AI Skill：图文存图、视频转文字稿、字幕优先免 GPU，附带知识库 MCP server。｜ Ingest Chinese content into your personal knowledge base — image/video routing, subtitle-first transcription, and a KB MCP server. Its tool list has not been published yet over stdio, requires no API key, and scores 73/100 on MCPpedia's security, maintenance and efficiency rubric.

AI / ML Education

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "chubbyskills": {
      "args": [
        "yt-dlp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/chubbyskills)](https://mcppedia.org/s/chubbyskills)

Read me

What Chubbyskills does

平时做内容、搭个人知识库，也写一些 AI Agent / Skill 的实践。我习惯把每天刷到的好东西——视频、播客、公众号、小红书、推特——自动收进自己的知识库，让信息真正沉淀下来，而不是看完就忘。这个仓库里的工具，就是这套工作流里我自己每天在用的那几件。

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'yt-dlp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

73/100across 5 weighted dimensions

How we score →

0255075100

−27

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

12 fixed

CVE-2026-55404high · fixedCVSS 7.5

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

### Summary If the `--write-link`, `--write-url-link` or `--write-desktop-link` options are used with yt-dlp, it may produce output that can lead to downstream remote code execution. An attacker can craft a malicious metadata payload to achieve arbitrary command injection in the `.url` and `.desktop` shortcut files written by yt-dlp. This allows for malicious shell commands or malicious remote executables to run on the user's system if the user executes the generated `.url` or `.desktop` files.

Affected: >= 0Fixed in 2026.7.4source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

### Summary If aria2c is used as an external downloader for a fragmented manifest format (such as an HLS/DASH stream), yt-dlp passes insufficiently sanitized input to aria2c that allows an attacker to perform an arbitrary file write. On Windows platforms, this can lead to immediate arbitrary code execution. On non-Windows platforms, this can lead to arbitrary code execution upon the next invocation of yt-dlp. ### Details When downloading a fragmented manifest format such as an HLS or DASH strea

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

### Summary A vulnerability exists in yt-dlp that allows a remote attacker to write arbitrary OS-shortcut files (such as `.desktop`, `.url`, `.webloc`) to the user's filesystem, bypassing the remediation for `CVE-2024-38519`. ### Details The fix for `CVE-2024-38519` enforced an allowlist for file extensions, in order to prevent writing files with unsafe extensions (such as `.exe` or `.sh`) during file downloads. However, this allowlist explicitly included the unsafe extensions `.desktop`, `.ur

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

### Summary If curl is used an external downloader for yt-dlp, cookies may be leaked to an unintended host upon HTTP redirect or when the host for download fragments differs from their parent manifest's. This is the equivalent to [GHSA-v8mc-9377-rwjj](<https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj>) for the `curl` downloader. The vulnerable behavior is present in [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2023.09.24. ### Details At the file download st

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

### Summary When yt-dlp's `--netrc-cmd` command-line option (or `netrc_cmd` Python API parameter) is used, an attacker could achieve arbitrary command injection on the user's system with a maliciously crafted URL. ### Impact yt-dlp maintainers assume the impact of this vulnerability to be high for anyone who uses `--netrc-cmd` in their command/configuration or `netrc_cmd` in their Python scripts. Even though the maliciously crafted URL itself will look very suspicious to many users, it would be

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Inventory

Tools (3)

Click any tool to inspect its schema.

~69 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Chubbyskills safe to use?: Chubbyskills has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Chubbyskills?: Chubbyskills supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Chubbyskills do?: Chubbyskills provides 3 tools: search_vault, read_kb_note, reindex_vault. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Chubbyskills?: Chubbyskills is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is Chubbyskills actively maintained?: Chubbyskills is actively maintained — last commit was 6 days ago. It has 639 GitHub stars.

Similar servers

Others in ai-ml / education

View all →

Dsh MCP Client97

MCP client bridge: connects to MCP servers and registers their tools on ctx.tools

193.9k 4

Gpt Researcher97

An autonomous agent that conducts deep research on any data using any LLM providers

29.1k 5

Modelcontextprotocol96

The official MCP server implementation for the Perplexity API Platform

2.5k 4

Antigravity Workspace Template96

Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.

1.3k 2

MCP Security Weekly

Get CVE alerts and security updates for Chubbyskills and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

This server has been archived and is no longer actively maintained.

Edit this pageView history

AI / ML Education

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "chubbyskills": {
      "args": [
        "yt-dlp"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/chubbyskills)](https://mcppedia.org/s/chubbyskills)

Read me

What Chubbyskills does

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'yt-dlp' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

中文 · English

🧰 Chubby Skills

信息流会忘，知识库会记，Agent 会用。

中文 Agent 内容采集的事实标准

内容创作者的知识资产管道 —— 把你每天刷到、听到、读到的好内容，变成可复用、可检索、可被 Agent 调用的选题库与知识资产。

生态定位：为什么不是又一个 skill 集合

Agent Skills 生态已有 140 万+ 技能包，但绝大多数是泛化开发技能；垂直领域（中文内容采集 → 知识库）至今没有事实标准。Chubby Skills 要占据的，就是这个位置。

维度	Chubby Skills	feedgrab	RSSHub	商业工具（Readwise / ima / NotebookLM）
中文平台全渠道采集	✅ 10 平台	⚠️ 7 平台	⚠️ 订阅源（非正文采集）	⚠️ 覆盖差 / 收费
视频 / 播客转录（字幕优先免 GPU）	✅	❌	❌	⚠️ 部分
知识库 + 语义检索 + MCP 闭环	✅ 完整	❌ 只抓不存	❌	⚠️ 封闭生态
本地运行 / 隐私	✅ 完全本地	✅ 本地	✅	❌ 云端
可被 Agent 编排（开放标准）	✅	✅	❌	❌
免费 / 零 API 费用	✅ 零依赖档位可用	✅	✅	❌ 订阅制

采集工具有很多，知识库工具也有很多。但「中文全渠道采集 → 统一格式 → 知识库 → Agent 调用」的完整闭环、且完全本地可迁移的，只有 Chubby Skills。

完整对比与生态定位图见 docs/comparison.md。

这是什么

Chubby Skills 是一套面向个人知识库和 AI Agent 的内容采集、整理、检索工具。

你可以把它理解成三层：

采集层：把 B站、YouTube、抖音、小红书、公众号、X、播客等内容转成统一 Markdown。
知识层：把 Markdown 入库到 Obsidian / 本地 vault，支持索引、搜索、语义检索、归档和知识卡片。
Agent 层：通过 Agent Skills 和 MCP server，让 Claude Code、Codex、OpenCode、OpenClaw、Hermes 等 Agent 真正读取你的知识库完成任务。

一句话：把你每天刷到、听到、读到的好内容，变成可复用、可检索、可被 Agent 调用的个人知识资产。

适合谁

内容创作者：把爆款笔记、视频、播客、公众号文章沉淀成选题库。
学习者：把视频和播客转成文字，再生成笔记、闪卡和知识点。
研究者：搭一个能被 Agent 检索的本地资料库。
Agent 用户：把 skill、CLI、MCP 和 vault 串成可复用工作流。
开源贡献者：按统一平台定义和输出协议扩展更多内容源。

现在有什么

当前版本：0.11.0

模块	能力	入口
平台采集	视频、图文、公众号、播客、X、小红书等内容转 Markdown	`tools/chubby_ingest.py` / 各 skill 脚本
管线编排	队列、状态、重试、日报、schema v1 元数据	`tools/chubby.py`
内容加工	摘要、要点、标签、价值判断	`content-enrich`
知识库	vault 模板、SQLite 索引、全文搜索、语义检索、最近笔记、统计	`tools/vault_index.py`
知识自动化	自动归档、知识卡片生成	`tools/vault_curator.py`
MCP	Agent 搜索、读取、重建索引、查看统计	`knowledge-base-management/scripts/mcp_server.py`
质量保障	平台健康度、smoke matrix、golden outputs、schema 校验	`tools/platform_health.py` / `tools/platform_smoke.py` / `tools/golden_outputs.py`
贡献者适配	新平台 definition / template / skill scaffold	`tools/platform_adapter.py`

60 秒开始

git clone https://github.com/chubbyguan/chubbyskills.git
cd chubbyskills
python3 tools/chubby.py quickstart

quickstart 是离线首跑验收，不会抓真实平台内容。它会检查：

配置和运行目录是否可写
X 链接 dry-run 路由是否正确
示例 Markdown 是否符合输出协议
平台定义和站点模板是否完整
示例 vault 是否能索引和语义检索
MCP 依赖是否可用

发布级验收：

python3 tools/chubby.py --version
python3 tools/platform_smoke.py --mode all --check
python3 tools/golden_outputs.py examples/outputs
python3 tools/mcp_workflow_demo.py

更多发布检查见 docs/release.md。

安装方式

推荐：分档安装

bash setup.sh          # 默认 light：轻量能力
bash setup.sh video    # 视频转录重依赖
bash setup.sh podcast  # 播客转录
bash setup.sh wechat   # 公众号/PDF 处理
bash setup.sh all      # 全部依赖
bash setup.sh doctor   # 只做环境体检

轻量模式可直接使用：X 图文、小红书图文、公众号基础处理、行业情报雷达、知识库健康检查、content-enrich。视频和播客转录才需要 ffmpeg、yt-dlp、funasr、torch、faster-whisper 等重依赖。

手动安装

pip install -r requi

... [View full README on GitHub](https://github.com/chubbyguan/chubbyskills#readme)

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

73/100across 5 weighted dimensions

How we score →

0255075100

−27

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

12 fixed

CVE-2026-55404high · fixedCVSS 7.5

yt-dlp: Downstream command injection via improper sanitization of yt-dlp --write-link output

Affected: >= 0Fixed in 2026.7.4source →

CVE-2026-50574high · fixedCVSS 8.3

yt-dlp: Arbitrary code execution via manifest downloads with aria2c

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50023high · fixedCVSS 8.3

yt-dlp: Dangerous file type creation via insufficient filename sanitization (Bypass of CVE-2024-38519)

Affected: >= 0Fixed in 2026.6.9source →

CVE-2026-50019medium · fixedCVSS 6.1

yt-dlp: File Downloader cookie leak with curl

Affected: >= 2023.9.24Fixed in 2026.6.9source →

CVE-2026-26331high · fixedCVSS 8.8

yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option

Affected: >= 2023.06.21Fixed in 2026.02.21source →

Inventory

Tools (3)

Click any tool to inspect its schema.

~69 tokens total

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Chubbyskills safe to use?: Chubbyskills has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under MIT.
How do I install Chubbyskills?: Chubbyskills supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What can Chubbyskills do?: Chubbyskills provides 3 tools: search_vault, read_kb_note, reindex_vault. See the full tools list on the server page for descriptions and parameters.
What AI clients work with Chubbyskills?: Chubbyskills is compatible with claude-desktop, cursor, claude-code. It uses stdio transport.
Is Chubbyskills actively maintained?: Chubbyskills is actively maintained — last commit was 6 days ago. It has 639 GitHub stars.

Similar servers

Others in ai-ml / education

View all →

Dsh MCP Client97

MCP client bridge: connects to MCP servers and registers their tools on ctx.tools

193.9k 4

Gpt Researcher97

An autonomous agent that conducts deep research on any data using any LLM providers

29.1k 5

Modelcontextprotocol96

The official MCP server implementation for the Perplexity API Platform

2.5k 4

Antigravity Workspace Template96

Workspace template + MCP server for Claude Code, Codex CLI, Cursor & Windsurf. Multi-agent knowledge engine (ag-refresh / ag-ask) that turns any codebase into a queryable AI assistant.

1.3k 2

MCP Security Weekly

Get CVE alerts and security updates for Chubbyskills and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?