TranscriptOut

• Outcome: Review
• Latest audit: Aug 23, 2026 · 7:53 PM UTC
• Version: 1.0.0

Overview

The skill mostly does what it claims, but its setup flow asks an agent to handle and persist sensitive account credentials with too little user-facing warning or control.

Review before installing. Use a dedicated TranscriptOut key with limited value, prefer storing it through a trusted secret manager instead of pasting it into chat, and avoid letting the skill process sensitive YouTube searches, channels, playlists, or bulk jobs unless you intend to share those inputs with TranscriptOut.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The file materially expands the skill from transcript retrieval into account creation, OTP handling, API key acquisition, persistent secret storage, and key verification. That broader authority is dangerous because it causes the agent to collect and manage credentials unrelated to the narrow user task, increasing the chance of secret exposure, unauthorized account actions, and misuse of persistent access.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The instructions tell the agent to ensure the API key persists across future sessions and non-interactive shells, which grants durable access beyond the immediate task. Persistent secret installation is risky in a chat-driven skill because it can silently widen access scope, survive user intent, and expose the key to other processes, tools, or future agent runs.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to conduct email-based registration and OTP verification on the user's behalf, effectively turning it into an identity and account-creation workflow. This is dangerous because it normalizes collection and relay of authentication factors in chat, creates opportunities for account takeover mistakes, and exceeds what is necessary for transcript operations.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The invocation description is broad enough to trigger on many generic YouTube-related tasks, which can cause the agent to route user requests to this external service even when that is unnecessary. That increases the chance of needless third-party data disclosure, credit consumption, and overuse of a networked skill beyond its least-privilege purpose.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly sends user-provided video URLs, IDs, handles, search queries, and playlist/channel identifiers to a third-party API, but it does not present a clear user-facing privacy warning or consent boundary. This can expose user interests, research topics, and potentially sensitive links to an external provider without adequate transparency.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The instructions ask the user to paste an API key or email without a clear warning that the key is a sensitive credential and that storing it persistently carries security consequences. In context, this omission is unsafe because users may disclose a powerful secret into a chat workflow without understanding retention, exposure, or cross-session use.

Ssd 3

High

• Confidence: 97% confidence
• Finding: This workflow explicitly instructs the agent to solicit a secret API key, receive it in chat, persist it, and then verify it by making authenticated requests. That is high risk because it places sensitive credentials directly in the conversational channel and agent execution path, where they may be logged, mishandled, reused across sessions, or exposed through tooling and integrations.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The fallback flow tells the user to generate a one-time-visible API key in the dashboard and immediately paste it to the agent. That is especially dangerous because one-time display tokens are meant to be handled carefully; routing them through chat defeats that protection and increases the likelihood of irreversible exposure if the value is logged or intercepted.

External Transmission

Medium

• Category: Data Exfiltration

Content

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## Transcript · 1 credit

• Confidence: 89% confidence
• Finding: This skill is designed to transmit request data to an external API endpoint, which is expected behavior for the integration, but it still creates a real data-exposure surface. In this context, the danger is not the mere presence of a URL, but that user inputs and metadata may be sent off-platform without minimization or explicit consent safeguards.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Channels
curl -s "https://api.transcriptout.com/v1/search?q=QUERY&type=channel&limit=10" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next page

• Confidence: 89% confidence
• Finding: The search examples show user queries being sent directly to the external API, which can reveal user interests, research themes, or monitoring targets. Because search terms may be more sensitive than raw video IDs, this usage is somewhat more privacy-relevant in context than ordinary metadata fetches.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages
curl -s "https://api.transcriptout.com/v1/channel/videos?next_page_token=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# IDs only, 500 per page (feed these into the bulk job)

• Confidence: 85% confidence
• Finding: Channel video enumeration sends creator/channel identifiers and pagination tokens to the external service. This is expected for functionality, but still exposes the user's monitoring interests and can enable broad collection behavior if invoked too eagerly due to the skill's broad scope.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages
curl -s "https://api.transcriptout.com/v1/playlist/videos?next_page_token=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# IDs only, 500 per page (feed these into the bulk job)

• Confidence: 85% confidence
• Finding: Playlist enumeration sends playlist identifiers and pagination tokens to a third-party endpoint, which can disclose what curated content a user is analyzing. The risk is contextual and primarily privacy-related, especially if the playlist itself is private in practice to the conversation even if publicly hosted on YouTube.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Results, readable before the job is done (free)
curl -s "https://api.transcriptout.com/v1/transcripts/JOB_ID/results?limit=100" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Cancel. Refunds only videos not started yet (free)

• Confidence: 90% confidence
• Finding: Bulk transcript job result retrieval implies prior submission of potentially large video sets to an external service, increasing the amount of user-directed collection exposed off-platform. In context, batch processing magnifies privacy and abuse risk because it can aggregate many videos, channels, or playlists in one operation.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.