Security audit

YouTube Data

Security checks across malware telemetry and agentic risk

Overview

This skill performs YouTube data lookup through TranscriptOut, but it needs review because it can have the agent create or sign into accounts, handle one-time codes and API keys, store credentials persistently, and send broad queries to a third-party service.

Install only if you are comfortable using TranscriptOut as a third-party processor for YouTube searches, video URLs or IDs, channel names, playlist IDs, and setup email addresses. Prefer creating the TranscriptOut account and API key yourself, store the key in an approved secret store, avoid pasting credentials into chat when possible, and use the skill only for explicit YouTube data requests, especially before bulk channel or playlist retrieval.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This file is fundamentally misaligned with the stated YouTube-data skill: it directs the agent to obtain TranscriptOut credentials, create third-party accounts, and persist API secrets. In a skill that should only retrieve YouTube-related data without a Google Cloud project or quota setup, these instructions create an unauthorized credential-harvesting and secret-persistence flow that could exfiltrate user data or establish long-lived access unrelated to the skill's purpose.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill instructs the agent to register accounts on behalf of the user, receive emailed one-time codes, mint API keys, and persist those keys for future sessions. That is dangerous because it expands the agent's authority from data retrieval into identity, account, and secret management for an unrelated service, creating opportunities for credential theft, unauthorized account provisioning, and durable compromise of the user's environment.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger language is broad enough to invoke the skill for loosely related 'topic research' or creator-name requests, which can cause unneeded calls to a third-party API. That increases the chance of unintended data disclosure and unnecessary credit consumption without clear user intent.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill routes user queries, YouTube URLs/IDs, and channel or playlist identifiers to TranscriptOut, but the description does not prominently warn users that this data is transmitted to a third-party service. This weakens informed consent and can expose potentially sensitive research interests or private video references.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The instructions ask the user to paste an API key directly into the conversation and offer to 'wire it up' without a clear warning that this is a sensitive credential that may be stored or transmitted. Collecting secrets in chat increases the risk of accidental logging, leakage to tools, or persistence in conversation history, especially when the skill later directs the agent to make the credential available across future sessions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: These steps instruct the agent to transmit user email data to a third-party service, handle access tokens via HTTP responses and temporary files, and continue toward persistent credential storage, but they do not clearly warn the user about the privacy, persistence, and account-side effects. Even if intended as operational guidance, this creates avoidable exposure of personal and authentication data through network calls and local storage mechanisms.

External Transmission

Medium

Category: Data Exfiltration
Content: ## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/video · 1 credit
Confidence: 91% confidence
Finding: This skill is explicitly designed to send data to an external API endpoint, which means user-provided identifiers and queries leave the local trust boundary. In context, external transmission is expected, but it remains a real security/privacy concern because the skill does not pair that behavior with strong consent and minimization guidance.

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # Channels curl -s "https://api.transcriptout.com/v1/search?q=QUERY&type=channel&limit=10" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # Next page
Confidence: 90% confidence
Finding: The search endpoint transmits free-form user queries to a third-party service, which can reveal sensitive interests, investigations, or internal topics. Because search terms may be much more revealing than simple public video IDs, this context makes the external transmission somewhat more sensitive than normal metadata retrieval.

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # Next pages curl -s "https://api.transcriptout.com/v1/channel/videos?next_page_token=TOKEN" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # IDs only, 500 per page (feed these into the bulk job)
Confidence: 87% confidence
Finding: Channel enumeration sends creator identifiers and can bulk-retrieve upload history, which may expose investigative intent and amplify data transfer beyond a single item. While aligned with the skill's purpose, the bulk nature increases privacy and cost risk if invoked unintentionally.

External Transmission

Medium

Category: Data Exfiltration
Content: -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # Next pages curl -s "https://api.transcriptout.com/v1/playlist/videos?next_page_token=TOKEN" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" # IDs only, 500 per page (feed these into the bulk job)
Confidence: 87% confidence
Finding: Playlist enumeration transmits playlist IDs/URLs and can retrieve entire collections, potentially exposing private research context or causing substantial unintended external querying. The skill context makes this behavior expected, but still risky when done without explicit notice and scoping.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.