Pub Youtube

• Outcome: Review
• Latest audit: Sep 11, 2026 · 8:45 PM UTC
• Version: 1.0.0

Overview

This package is labeled as a YouTube transcript helper but actually documents a broad third-party API gateway with email, SMS, media generation, search, scraping, and arbitrary model calls.

Review this as a broad SkillBoss API gateway, not a narrow YouTube transcript watcher. Install only if you intend to let the agent use your SKILLBOSS_API_KEY for external model calls and potentially send prompts, documents, audio, image URLs, email addresses, and phone numbers to third-party services; avoid using it for communication actions unless you can enforce explicit user approval and recipient checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (43)

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill is presented as a narrow YouTube transcript watcher, but the documentation exposes a broad general-purpose broker for chat, generation, scraping, email, and SMS. This scope mismatch is dangerous because users or higher-level agents may grant trust, inputs, and privileges appropriate for transcript retrieval while the skill actually enables unrelated outbound actions and data flows.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Outbound email is unrelated to YouTube transcript retrieval and creates a direct exfiltration and action channel. In the context of a seemingly harmless summarization skill, this hidden breadth increases the risk that user content, summaries, or sensitive data could be transmitted externally without informed consent.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: SMS OTP send/verify capability is highly unrelated to transcript watching and introduces sensitive identity and communications functionality. This broadens the skill into user-targeted external actions that could be abused for unsolicited messaging, phishing workflows, or handling of personal phone numbers under a misleading skill identity.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: Email and SMS sending capabilities are high-risk outbound communication functions that are unrelated to the stated transcript-reading purpose. If exposed through this skill, they could be abused for spam, phishing, OTP workflows, or unauthorized notifications under the cover of a benign-seeming YouTube utility.

External Transmission

Medium

• Category: Data Exfiltration

Content

One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

• Confidence: 85% confidence
• Finding: The base URL declaration establishes that the skill depends on a third-party API for many operations, meaning user data and prompts may leave the local environment. In isolation this is common, but here it contributes to a broad and under-disclosed external trust dependency.

External Transmission

Medium

• Category: Data Exfiltration

Content

## List Models

```bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 84% confidence
• Finding: The models-list call is an external request that leaks at least token usage and environment metadata to a third-party service. While low severity on its own, it confirms unnecessary external connectivity in a skill whose declared purpose is much narrower.

External Transmission

Medium

• Category: Data Exfiltration

Content

## List Models

```bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 84% confidence
• Finding: The models-list call is an external request that leaks at least token usage and environment metadata to a third-party service. While low severity on its own, it confirms unnecessary external connectivity in a skill whose declared purpose is much narrower.

External Transmission

Medium

• Category: Data Exfiltration

Content

Filter by type:

```bash
curl -s "https://api.heybossai.com/v1/models?types=image" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 84% confidence
• Finding: Filtering models by type still makes an external call and supports generic capability discovery rather than transcript retrieval. This broadens what downstream agents may attempt with the skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

Get full docs for specific models:

```bash
curl -s "https://api.heybossai.com/v1/models?ids=mm/img,bedrock/claude-4-5-sonnet" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"
```

• Confidence: 84% confidence
• Finding: Fetching full docs for arbitrary models is an external transmission path that facilitates broad general-purpose use of the API. In this context, it amplifies the scope mismatch and supports capabilities unrelated to transcript watching.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: A general chat completion and smart-routing interface turns the skill into a generic LLM gateway rather than a dedicated transcript watcher. This makes the skill more dangerous because arbitrary prompts and data can be routed to external model providers under the guise of a narrow-purpose tool.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Chat

```bash
curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 89% confidence
• Finding: The chat completions endpoint sends arbitrary prompts and content to an external provider. Because this skill is framed as a transcript watcher, that generic external prompt channel is more dangerous than it would be in a clearly labeled LLM gateway.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: Image and video generation are unjustified by the stated transcript-reading purpose and materially expand what the skill can do. Even if not inherently malicious, this scope creep undermines least privilege and increases the chance of misuse, surprise charges, or unreviewed external data transfers under a misleading skill label.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: This external run endpoint is used for image generation and transmits prompts to a third party. It is unnecessary for the stated use case and enlarges the skill's data exposure surface.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Image Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: This external run endpoint is used for image generation and transmits prompts to a third party. It is unnecessary for the stated use case and enlarges the skill's data exposure surface.

External Transmission

Medium

• Category: Data Exfiltration

Content

Save to file:

```bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \

• Confidence: 88% confidence
• Finding: This workflow not only sends a generation request externally but also retrieves a returned URL, increasing network interaction and data movement. That is excessive for a transcript-reading skill and can lead to additional unreviewed content fetching.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: The video generation call forwards user prompts to an external API and expands the skill into unrelated media creation. This widens the outbound attack surface and departs from least privilege.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Video Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: The video generation call forwards user prompts to an external API and expands the skill into unrelated media creation. This widens the outbound attack surface and departs from least privilege.

External Transmission

Medium

• Category: Data Exfiltration

Content

Image-to-video:

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: The image-to-video example sends both text and a user-specified image URL externally, which may expose third-party or sensitive media. It is not justified by the advertised skill purpose.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: TTS, STT, and music generation are not necessary for a dedicated YouTube transcript watcher and expand processing of user audio/text beyond the declared purpose. This can lead to unexpected transmission of audio content and unnecessary privilege exposure.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: This TTS external call transmits user text to a third party and may return remote-hosted audio. It is another unnecessary data transfer path for this skill's declared function.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Text-to-Speech

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 88% confidence
• Finding: This TTS external call transmits user text to a third party and may return remote-hosted audio. It is another unnecessary data transfer path for this skill's declared function.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The speech-to-text external call uploads raw audio content, which can be highly sensitive and may reveal identities or private conversations. This is particularly concerning because the skill description does not prepare users for such audio uploads.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Speech-to-Text

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 90% confidence
• Finding: The speech-to-text external call uploads raw audio content, which can be highly sensitive and may reveal identities or private conversations. This is particularly concerning because the skill description does not prepare users for such audio uploads.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Music Generation

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 87% confidence
• Finding: Music generation transmits prompts externally and supports nonessential functionality unrelated to transcript watching. This broadens potential data egress and billing abuse without clear justification.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Background Removal

```bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

• Confidence: 86% confidence
• Finding: Background-removal requests send image references or content to an external service, expanding third-party exposure beyond the skill's advertised purpose. It is another sign of overbroad functionality hidden inside a narrowly named skill.

Static analysis

No suspicious patterns detected.