Security audit

video-transcript

Security checks across malware telemetry and agentic risk

Overview

The skill has a coherent transcript purpose, but its setup asks the agent to handle account signup, OTP-based authentication, raw API keys, and persistent secret storage in ways users should review carefully.

Install only if you are comfortable sharing YouTube video identifiers with TranscriptOut and letting the agent help manage a TranscriptOut credential. Prefer creating the account and API key yourself, storing it in an approved secret manager, and avoiding persistent shell-profile storage unless you understand where the key will live and how to revoke it.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The document materially expands a video-transcript skill into third-party account creation, email-based authentication handling, API key issuance, and persistent secret management. That broader behavior increases the attack surface and enables the agent to perform sensitive identity and credential operations unrelated to the core user intent of transcription.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The instructions direct the agent to persistently store an API key and modify environment configuration so the secret survives future sessions and shells. Persisting secrets on the host outside a dedicated secret manager is dangerous because it can expose credentials to later processes, other users, logs, or unrelated tasks, especially when the skill's stated purpose does not justify such system-level changes.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The manifest description contains broad trigger language such as handling a pasted YouTube link, summarization, translation, fact-mining, and even a bare URL with 'what does this say?'. This can cause the orchestrator to invoke the skill for common conversational requests more often than necessary, increasing unintended data transfer to the external transcript service and raising privacy and cost exposure.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill tells the agent to send video identifiers and related request data to api.transcriptout.com, but the user-facing description does not clearly warn that an external third-party service will receive that data. This creates a privacy and consent risk, especially when broad invocation criteria may cause users' links or requests to be transmitted off-platform without explicit awareness.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill tells the agent to persistently store the user's API key for future sessions without requiring a clear warning that the secret will remain on the machine and may be accessible beyond the current task. This undermines informed consent and can lead users to disclose credentials they would not have shared if the retention behavior were explicit.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions explicitly tell the agent to solicit authentication material, retain it in temporary files, and work around runtime secret redaction by reading tokens from files instead of allowing protective controls to scrub them. Guidance to bypass redaction is a strong red flag because it defeats platform safeguards designed to prevent the model from accessing or exposing sensitive credentials.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.