YouTube Full

• Outcome: Review
• Latest audit: Aug 23, 2026 · 7:44 PM UTC
• Version: 1.0.0

Overview

This is a useful YouTube transcript/search skill, but it asks the agent to handle signup codes and API keys and store credentials persistently, so it belongs in Review before installation.

Install only if you are comfortable sending YouTube searches, channel or playlist identifiers, and selected video IDs to TranscriptOut. Prefer creating the TranscriptOut account and API key yourself in the browser, store the key in a scoped secret manager rather than a general persistent shell environment, and require confirmation before bulk jobs or sensitive research queries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file instructs the agent to create and manage TranscriptOut accounts and credentials, which is materially outside the stated YouTube-focused purpose of the skill. That scope expansion is dangerous because it enables collection of user email addresses, OTPs, and API keys for an unrelated third-party service, increasing phishing, secret-handling, and account-abuse risk.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The instructions tell the agent to persistently store an API key so it survives future sessions and non-interactive shells, giving the skill long-lived access to a sensitive credential unrelated to the advertised YouTube functionality. Persistent secret installation increases blast radius if the agent, runtime, or other skills are later compromised, and can create covert cross-session access without clear user awareness.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The file directs the agent to perform email-based registration and OTP verification for an external service, including handling a one-time code and bearer token. That grants the skill an unnecessary identity and authentication workflow beyond its stated purpose, which can be abused for account creation, takeover-style social engineering, or secret interception.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The activation text is unusually broad and explicitly says to invoke the skill even when YouTube is not mentioned, including generic research, summarization, translation, and product-launch discovery tasks. That can cause the agent to route ordinary user queries to this third-party-backed skill unnecessarily, increasing unintended data exposure and API usage.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explains how to send requests to TranscriptOut but does not clearly warn that user queries, video/channel identifiers, playlist IDs, and potentially large transcript requests are transmitted to an external third-party service. Without explicit disclosure and consent guidance, users may unknowingly send sensitive research topics or watched-target identifiers off-platform.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill tells the agent to store a sensitive API key persistently and to transmit it in authentication requests, but it does not require an explicit warning or consent step about long-term storage, cross-session reuse, or network transmission. This weakens user awareness and informed consent around secret handling, making accidental overexposure more likely.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow explicitly instructs the agent to ask for, receive, process, persist, and reuse highly sensitive secrets and authentication artifacts including API keys, access tokens, email addresses, and OTPs. This is dangerous because natural-language handling of secrets broadens exposure to logs, prompt injection, model context retention, and misuse by unrelated tools or future sessions.

External Transmission

Medium

• Category: Data Exfiltration

Content

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## Transcript · 1 credit

• Confidence: 89% confidence
• Finding: This skill is designed around sending data to api.transcriptout.com, so external transmission is expected, but it still creates a real privacy and data-handling risk because user prompts and YouTube identifiers leave the local environment. The danger is amplified by the skill's broad invocation guidance, which may cause third-party transmission for tasks the user did not realize would use an outside service.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Channels
curl -s "https://api.transcriptout.com/v1/search?q=QUERY&type=channel&limit=10" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next page

• Confidence: 88% confidence
• Finding: The search examples transmit arbitrary query text to an external service, which can include sensitive research interests, names, or confidential topics. Because the skill encourages use for broad research tasks, this endpoint can exfiltrate more user intent than a narrowly scoped YouTube helper should.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages
curl -s "https://api.transcriptout.com/v1/channel/videos?next_page_token=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# IDs only, 500 per page (feed these into the bulk job)

• Confidence: 86% confidence
• Finding: Channel video listing sends channel identifiers and pagination tokens to the third-party API, potentially revealing what creators or organizations the user is investigating at scale. In the context of batch collection and 500-ID extraction, this can expose substantial interest profiles or monitoring targets.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages
curl -s "https://api.transcriptout.com/v1/playlist/videos?next_page_token=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# IDs only, 500 per page (feed these into the bulk job)

• Confidence: 86% confidence
• Finding: Playlist enumeration reveals playlist identifiers and potentially the full contents of curated lists to a third-party service. For private, sensitive, or business-related playlists shared with the agent, this may disclose user interests or investigative scope beyond what is necessary.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Results, readable before the job is done (free)
curl -s "https://api.transcriptout.com/v1/transcripts/JOB_ID/results?limit=100" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Cancel. Refunds only videos not started yet (free)

• Confidence: 87% confidence
• Finding: Bulk job result retrieval is part of an asynchronous pipeline that can process up to thousands of videos, creating a larger-volume external processing and metadata exposure risk than one-off transcript fetches. Even though this endpoint reads results, it reflects and supports mass third-party handling of the user's selected targets.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# 2. One job for all of them
curl -s -X POST "https://api.transcriptout.com/v1/transcripts" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"videos":["ID1","ID2","..."],"format":"text"}'

• Confidence: 90% confidence
• Finding: Submitting a bulk transcript job can send hundreds or thousands of video IDs to the external provider, making large-scale data transfer and profiling possible. This is especially risky because the skill explicitly promotes 4,000-video jobs, which increases the chance of accidental over-collection, unnecessary cost, and privacy leakage.

Static analysis

No suspicious patterns detected.