Security audit

subtitles

Security checks across malware telemetry and agentic risk

Overview

This subtitle skill is mostly coherent, but its setup gives the agent broad responsibility for account signup, OTP handling, API-key handling, and persistent secret storage.

Review before installing. The subtitle API use is clear, but setup may let the agent create or sign into a TranscriptOut account, receive an OTP, handle an API key, and store that key persistently for future shells. Prefer creating the account and key yourself in the provider dashboard, store the key in a scoped secret manager when possible, and revoke the key if it is pasted into chat or stored somewhere too broad.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file materially expands the skill from subtitle retrieval into third-party account creation, OTP handling, API key issuance, and persistent credential storage. That broadens the agent's authority to manage user identity and secrets in ways not justified by the declared purpose, increasing the chance of credential mishandling, unauthorized account actions, or unsafe secret persistence.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The instructions require persistent storage of `TRANSCRIPTOUT_API_KEY` for all future sessions and non-interactive shells before any actual subtitle task is performed. Persisting a long-lived API key system-wide or runtime-wide without tight scoping is dangerous because it increases secret exposure across unrelated workflows, shells, and tools.

Context-Inappropriate Capability

High

Confidence: 94% confidence
Finding: The skill embeds a full signup/sign-in flow using email-based OTPs and API key generation, which is outside the declared subtitle-only scope. Having the agent orchestrate authentication and receive sensitive verification material creates unnecessary exposure to account takeover risks, phishing-like interaction patterns, and secret leakage through logs or tooling.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The skill instructs the agent to send user-supplied YouTube URLs/IDs and an API bearer token to a third-party service, but it does not clearly warn users about that external data transfer in the user-facing description. This can undermine informed consent and surprise users who may not expect their requested video targets and credentials to be transmitted off-platform, even though the transmitted data appears limited to the video identifier/URL and the API key.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill asks the user to paste an API key or provide an email for account creation, but does not clearly warn that the agent will handle sensitive credentials and may persist them across sessions. This undermines informed consent and can lead users to disclose secrets without understanding storage, retention, or exposure risks.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The browser fallback tells the user to paste a one-time-visible API key into the agent without a strong warning that this is a sensitive secret. Because the key is shown once and can grant ongoing API access, encouraging copy-paste into the agent increases the chance of irreversible exposure or insecure persistence.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.