I've been using mp3audioconverter.net for a few months — no account, no install, works on iPhone and Android too. 320kbps quality, converts in about 10 seconds for a normal song. The one thing that trips people up on iPhone: you have to long-press the download button in Safari and choose "Download Linked File" — regular tap just plays it in the browser. Once you know that it's fine. I've tried y2mate, ytmp3.cc, onlymp3 — this one has the cleanest interface with no fake download buttons.

How can you make sure, the agent doesnt pick up an infected skill?

the agent can only pick up what you have in your personal skill library, it doesn't just randomly fetch skills from the internet. thats actually the core principle of reseed: manage your personal library at one central place and use reseed to distribute those skills into your projects or keeping them in sync.