YouTube Playlist

• Outcome: Review
• Latest audit: Aug 23, 2026 · 7:52 PM UTC
• Version: 1.0.0

Overview

The skill does the advertised YouTube playlist and transcript work, but its setup flow asks the agent to handle account signup, OTPs, API keys, temporary secret files, and persistent local credential storage without enough safety boundaries.

Review this skill before installing if you are not comfortable letting an agent handle TranscriptOut account setup, email OTPs, API keys, and persistent credential storage. Prefer creating the TranscriptOut API key yourself in the provider dashboard and storing it through your agent platform's approved secret manager. Avoid using private or sensitive playlists unless you accept that playlist and video metadata will be sent to TranscriptOut.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: This file materially expands the skill beyond YouTube playlist handling into third-party account registration, OTP-based authentication, secret collection, secret persistence, and runtime-specific storage guidance. That broadening is dangerous because it induces the agent to handle credentials and authentication flows unrelated to the user-visible skill scope, increasing the risk of secret exposure, unauthorized account actions, and abuse of the agent as a credential broker.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The instructions explicitly tell the agent to persistently store an API key on the user's machine for future sessions and non-interactive shells. Persistent local secret installation is risky because the storage location may be world-readable, inherited by unrelated processes, committed to shell profiles, or left behind after the task, creating long-lived credential exposure.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The skill directs the agent to register accounts, receive a session token, prompt for a one-time code, and complete verification to mint a new API key on the user's behalf. Even with user participation, this turns the agent into an authentication intermediary handling sensitive tokens and OTPs, which increases the chance of credential mishandling, phishing-like behavior, and unauthorized account lifecycle actions outside the skill's core purpose.

Missing User Warnings

Low

• Confidence: 92% confidence
• Finding: The skill directs users to obtain an API key and use a third-party service, but it does not clearly warn that playlist URLs/IDs and bulk video ID lists will be transmitted to TranscriptOut. This is a real transparency/privacy issue because users may not realize their YouTube activity metadata is being sent off-platform, especially during bulk transcript jobs.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The prompt asks the user to paste an API key or provide an email for account creation without a clear warning that the agent will handle sensitive credentials and may persist them locally. This is dangerous because users may disclose secrets or personal data without informed consent about storage, exposure surface, or safer alternatives.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The document instructs the agent to write authentication responses containing access tokens to temporary files and later do the same with API-key-bearing responses. Writing secrets to temp files creates a local exposure window through filesystem permissions, lingering artifacts, backup/indexing, or reuse of predictable temp paths, especially since the skill gives no concrete safeguards beyond eventual deletion.

External Transmission

Medium

• Category: Data Exfiltration

Content

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## GET /v1/playlist/videos · 1 credit/page

• Confidence: 88% confidence
• Finding: This skill is explicitly designed to send requests to an external API endpoint, including authorization credentials and user-supplied playlist references. In context this is expected functionality, but it still constitutes a genuine data egress/security concern because user data and API usage are exposed to a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages
curl -s "https://api.transcriptout.com/v1/playlist/videos?next_page_token=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# IDs only, 500 per page (feed these into the bulk job)

• Confidence: 84% confidence
• Finding: The paginated playlist retrieval flow repeatedly sends playlist references and bearer-authenticated requests to the external TranscriptOut API. While aligned with the skill's purpose, repeated external transmission increases exposure of user-supplied playlist metadata and creates dependency on a third-party processor.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# 2. One bulk job for every video
curl -s -X POST "https://api.transcriptout.com/v1/transcripts" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"videos":["ID1","ID2","..."],"format":"text"}'

• Confidence: 95% confidence
• Finding: The bulk transcript workflow sends a full list of video IDs to a third-party API, which can reveal the contents and structure of an entire playlist or course. This is more sensitive than a single lookup because it enables large-scale disclosure of user-selected media interests and content collections to an external service.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.