Security audit

YouTube API

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for using a third-party YouTube transcript API, but it asks the agent to create/manage an account and persist a reusable API key with weak scoping and disclosure.

Review this before installing if you are not comfortable letting an agent handle your TranscriptOut signup flow or store a reusable API key persistently. Prefer providing a key through a scoped secret manager, avoid putting sensitive non-YouTube content in searches or URLs, and remove the key from local environment or profile storage when no longer needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The document instructs the agent to perform account registration, email OTP handling, and persistent API key setup for a third-party service, which is materially broader than a YouTube data retrieval skill’s stated scope. This expands the skill into credential brokerage and identity-linked account management, creating unnecessary access to user secrets and personal data and increasing the blast radius if the skill is misused or compromised.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: The file directs the agent to persistently store an API key across future sessions and manage authentication state, including verifying availability in current and later shells. Persisting secrets at the agent’s direction can expose credentials to other processes, future tasks, or users of the machine, and is not clearly necessary for the described one-off YouTube data access use case.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: The skill asks the user to paste an API key or provide an email address without first warning how those sensitive values will be handled, stored, or transmitted. This can lead users to disclose credentials and personal data without informed consent, especially because the same document later describes creating accounts and persisting secrets.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instructions tell the agent to store the API key persistently so future non-interactive sessions can access it, but they do not warn the user about long-term credential persistence on the machine. Without explicit notice and consent, users may unknowingly leave a reusable bearer credential exposed beyond the immediate task.

External Transmission

Medium

Category: Data Exfiltration
Content: ## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## Endpoint Reference
Confidence: 94% confidence
Finding: The skill instructs sending requests, including a bearer API key, to an external third-party service. Any user-supplied YouTube URLs, handles, search terms, or transcript targets will be transmitted off-platform, creating data exposure and credential-use risk if users are unaware or if sensitive inputs are passed through this skill.

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # Search curl -s "https://api.transcriptout.com/v1/search?q=rust+lifetimes&limit=10" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # A channel's uploads
Confidence: 93% confidence
Finding: This example demonstrates external transmission to a third-party API using an Authorization bearer token. Even though it is an example, it operationalizes off-platform data sharing and authenticated requests, which can expose user queries and consume a secret-backed account if invoked without clear consent and data-handling boundaries.

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # A channel's uploads curl -s "https://api.transcriptout.com/v1/channel/videos?name=@3blue1brown" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # A playlist
Confidence: 93% confidence
Finding: This example sends channel identifiers to an external service using a bearer-authenticated request. In context, the skill is designed for internet-backed YouTube lookups, so the behavior is expected, but it still constitutes real external data transmission and secret usage that could leak user intent or metadata to the provider.

Static analysis

No suspicious patterns detected.