Security audit

captions

Security checks across malware telemetry and agentic risk

Overview

This caption skill has a coherent purpose, but its setup flow asks the agent to handle email sign-in codes, API keys, temporary token files, and broad persistent credential storage.

Install only if you are comfortable letting the agent help create or configure a TranscriptOut account and handle the TranscriptOut API key. Prefer creating the key yourself in the official dashboard and storing it in a scoped secret manager rather than pasting keys or OTPs into chat or making the key available to all future shells.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file materially expands the skill’s scope from caption retrieval into full account creation, OTP-based authentication, API key issuance, and persistent credential setup. That broader auth/provisioning workflow increases the attack surface and encourages the agent to perform sensitive identity and secret-management actions that are not necessary for the core caption-reading purpose.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The documentation instructs persistent storage of `TRANSCRIPTOUT_API_KEY` across future sessions and shells, but that persistence is not clearly justified by a caption retrieval task. Persisting user secrets broadly increases exposure to accidental disclosure, reuse by unrelated tasks, and compromise via other tools or sessions.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The skill sends user-supplied YouTube URLs/IDs and the user's TranscriptOut API credential to an external third-party service, but the description and surrounding guidance do not clearly disclose that data flow. This is primarily a transparency and consent issue: users may not realize their requested video targets and authentication token are being shared with transcriptout.com, which can matter for privacy, enterprise policy, or regulated environments.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The workflow asks users to paste an API key or provide an email for automated signup without a clear warning that the agent will receive, process, and potentially store sensitive credentials. Users may disclose secrets or personal data without understanding retention, transmission, or persistence implications.

Ssd 3

High

Confidence: 96% confidence
Finding: The instructions direct the agent to solicit an API key and one-time login code, extract tokens from files, and persist the resulting secret for future sessions. This is dangerous because it turns the agent into an active credential broker with access to authentication factors and long-lived API secrets, creating significant risk of account takeover, secret leakage, and misuse if logs, temp files, or the runtime are compromised.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.