scraping-youtube-playlist

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:20 AM UTC
• Version: 1.0.0

Overview

This skill is a disclosed Apify-based YouTube playlist metadata scraper, with some optional inputs users should handle carefully.

Install only if you are comfortable sending playlist URLs, search keywords, locale settings, and run parameters to Apify/apidojo. Avoid private or sensitive playlist identifiers unless that third-party processing is acceptable, and do not use customMapFunction unless you trust and understand the JavaScript being supplied.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Allowing an arbitrary customMapFunction JavaScript string introduces a powerful, unjustified code-like transformation surface in a skill whose stated purpose is simple playlist scraping. Even if execution occurs inside Apify, this enables unreviewed logic to process scraped data and may be abused to exfiltrate, reshape, or expand handling of data in ways users and the host agent did not intend.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented keywords input expands the skill from scraping a user-supplied playlist URL into discovery/search behavior, which changes the data collection scope and can cause collection from unintended playlists. This is risky because users may believe they are only processing a known playlist while the skill can initiate broader third-party searches via Apify.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to send playlist URLs and parameters to Apify/apidojo without an explicit privacy warning or consent note. This omission is dangerous because user-supplied URLs, queries, and potentially sensitive playlist identifiers are transmitted to a third party, which may violate user expectations or organizational data-handling policies.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The presence of https://api.apify.com/ confirms that the skill depends on a third-party endpoint for operation, creating an external trust boundary. While not malicious, this is dangerous when undocumented because users may not realize their requests and metadata leave the local environment and are processed by Apify/apidojo.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

REST API fallback

bash

curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-playlist-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.youtube.com/playlist?list=PLABCDE12345"], "maxItems": 50}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The presence of https://api.apify.com/ confirms that the skill depends on a third-party endpoint for operation, creating an external trust boundary. While not malicious, this is dangerous when undocumented because users may not realize their requests and metadata leave the local environment and are processed by Apify/apidojo.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

REST API fallback

bash

curl -X POST "https://api.apify.com/v2/acts/apidojo~youtube-playlist-scraper/runs" \
  -H "Authorization: Bearer $APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"startUrls": ["https://www.youtube.com/playlist?list=PLABCDE12345"], "maxItems": 50}'

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes a focused output of video title, URL, view count, like count, duration, channel info, and description. The statement 'returns the full dataset for downstream analysis' implies a broader and less constrained data collection scope than the manifest advertises.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The inputs table establishes English and US locale defaults, which can steer results toward a specific language and region. Because the documentation does not mention that users can or should choose locale settings, this is a natural-language policy concern under the language/locale rule.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.