YouTube Transcript Extractor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:37 PM UTC
• Version: 1.0.0

Overview

This appears to be a YouTube transcript helper, but it needs Review because its documented behavior does not fully match the shipped scripts and its lockfile contains scanner-flagged vulnerable dependencies.

Review the package before installing, especially the dependency versions and the missing or unclear /root/clawd/yt-transcript wrapper. Treat YouTube URLs or IDs as data that may be sent to YouTube, Supadata, or third-party transcript libraries, and avoid using sensitive/private video references or API keys unless you trust that data flow.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (9)

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence
• Finding: The lockfile pins axios 1.13.4, and the supplied advisories include multiple high-severity issues affecting request handling, including SSRF/proxy-bypass and prototype-pollution-related attack paths. In a skill that retrieves YouTube data over HTTP, a vulnerable HTTP client is security-relevant because attacker-controlled URLs, redirects, proxy settings, or polluted objects could alter outbound requests, leak credentials, or enable response tampering.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 89% confidence
• Finding: form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames. If any part of multipart construction incorporates attacker-controlled values, this can corrupt request boundaries or inject unintended headers/content, which may enable request smuggling-style effects or abuse of downstream parsers.

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High

• Category: Supply Chain
• Confidence: 90% confidence
• Finding: lodash 4.17.23 is flagged for prototype pollution and template/code-injection issues. Even if the vulnerable APIs are not obviously used in this specific file, a polluted object graph in a Node.js skill can have broad security consequences, especially alongside HTTP libraries where polluted configuration objects can influence requests or bypass safeguards.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill explicitly states it uses the Supadata API as a primary method, but it does not warn users that supplying a YouTube URL or video ID sends that identifier to an external service. This creates a transparency and privacy issue: users may assume processing is local, while their requested content metadata is disclosed to a third party without notice.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 86% confidence
• Finding: follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because this dependency is used by axios, any authenticated outbound request that follows an attacker-influenced redirect could disclose sensitive headers to a different host.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"author": "",
  "license": "ISC",
  "dependencies": {
    "youtube-captions-scraper": "^2.0.3",
    "youtube-transcript": "^1.2.1",
    "youtubei.js": "^16.0.1"
  }

• Confidence: 95% confidence
• Finding: The dependency uses a caret range (^2.0.3), which allows newer compatible versions to be installed over time. This can introduce supply-chain risk because future package releases may contain vulnerabilities or malicious code without any change to this repository.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"license": "ISC",
  "dependencies": {
    "youtube-captions-scraper": "^2.0.3",
    "youtube-transcript": "^1.2.1",
    "youtubei.js": "^16.0.1"
  }
}

• Confidence: 95% confidence
• Finding: The dependency uses a caret range (^1.2.1), so installs are not fully reproducible and may resolve to newer upstream releases. That increases exposure to accidental vulnerable updates or dependency compromise in the software supply chain.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"dependencies": {
    "youtube-captions-scraper": "^2.0.3",
    "youtube-transcript": "^1.2.1",
    "youtubei.js": "^16.0.1"
  }
}

• Confidence: 95% confidence
• Finding: The dependency uses a caret range (^16.0.1), permitting automatic uptake of later versions within the major release line. In a package manifest, this weakens build reproducibility and creates a supply-chain attack surface if an upstream release is compromised.

Missing User Warnings

Low

• Confidence: 90% confidence
• Finding: The script makes an outbound network request to YouTube subtitle infrastructure via a third-party library without notifying the user at runtime. This is a real but low-severity issue because users may not realize that invoking the skill transmits the supplied video identifier and associated metadata to an external service, which can matter in privacy-sensitive or restricted-network environments.

Static analysis

No suspicious patterns detected.