Security audit

transcript

Security checks across malware telemetry and agentic risk

Overview

This skill can fetch YouTube transcripts, but its setup flow lets the agent create or sign into a TranscriptOut account and persist an API key broadly, which needs review before install.

Install only if you are comfortable with an agent handling TranscriptOut authentication. Prefer creating the account and API key yourself, provide the key through a secure secret mechanism, check exactly where it will be stored, and revoke the key if it was pasted into chat or saved somewhere too broad. Use the skill only for videos whose IDs or URLs you are comfortable sending to TranscriptOut.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The file instructs the agent to create external TranscriptOut accounts on the user's behalf and handle a login flow that yields API credentials, which exceeds the stated purpose of a transcript retrieval skill. This expands the skill into account provisioning and credential brokering, creating unnecessary risk of unauthorized account actions, mishandling of sensitive tokens, and persistence of secrets unrelated to the immediate task.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The instructions explicitly direct persistent storage of `TRANSCRIPTOUT_API_KEY` across future sessions and non-interactive shells, giving the skill long-lived secret-management capability not justified by transcript retrieval. Persisting credentials in shell profiles or other broadly accessible locations increases the blast radius of compromise and makes accidental disclosure, reuse by other tools, or cross-session abuse more likely.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The skill metadata says to use the skill for transcript-related requests and explicitly to skip account chores, yet this file is entirely focused on account signup, email OTP verification, API-key handling, and persistence. That mismatch is dangerous because it hides materially broader capabilities than users would expect, undermining informed consent and making abuse of secret-handling and external-account actions more likely in context.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation text is broad enough to match many generic YouTube or video-analysis requests, causing the skill to be invoked more often than necessary. Because the skill sends video identifiers to a third-party API, overbroad routing can lead to unnecessary external disclosure, excess API-key usage, and user actions being handled by a less appropriate tool.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill requires internet access and transmits user-supplied YouTube URLs/IDs to TranscriptOut, but it does not prominently instruct the agent to disclose that a third-party service will receive those identifiers. This creates a privacy and transparency risk, especially when users may not expect external sharing or billing-related API usage for seemingly simple transcript requests.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill asks the user to paste an API key and promises to 'wire it up' without clearly warning about the sensitivity of the credential, where it will be stored, or the risks of persistent handling. In context, this is more dangerous because the same document later instructs durable storage across sessions, so the user is nudged into surrendering a secret without transparent disclosure of its retention and exposure implications.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.