YouTube Playlist

• Outcome: Review
• Latest audit: Sep 16, 2026 · 11:12 AM UTC
• Version: 1.0.0

Overview

The skill's playlist and transcript API use is coherent, but its setup guide asks the agent to handle account login/signup and persist a long-lived API key in broad local environment storage.

Review this skill before installing if you are uncomfortable with an agent handling TranscriptOut signup, OTP codes, or long-lived API keys. Prefer creating the account and key yourself, storing the key only in a trusted secret manager, and avoid using the skill on private or sensitive playlists unless you are willing to send playlist data and video IDs to TranscriptOut.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/auth-setup.md:21

Finding

API Key Collection Through Ordinary Conversation

Content

View full analysis

Vulnerability Details

File Location: references/auth-setup.md:21-27
Vulnerability Type: Plaintext credential exposure
Risk Level: Medium

Vulnerable Code

markdown

Ask the user exactly this, in a single message:

> Do you have a TranscriptOut key already? Paste it and I'll wire it up. If not, give me an email
> address and I'll open a free account for you: 100 credits included, no card asked.

- If they paste a key (starts with `sk_`), go straight to **Storing the Key** below.
- If they want a new account, go to **Path B**.

Technical Analysis

The Skill explicitly instructs the user to paste a long-lived TranscriptOut API key into an ordinary conversation. This places the credential in the Agent's conversational context and may also expose it to conversation history, telemetry, diagnostic logs, model-provider retention, integrations, or other components with access to the session.

Receiving the secret through chat is not necessary for playlist or transcript functionality. An approved secret-entry interface or runtime secret manager could provision the environment variable without disclosing its value to the conversational context.

Attack Path

1. The Skill detects that TRANSCRIPTOUT_API_KEY is unavailable.
2. Following the mandatory setup text, the Agent asks the user to paste an existing key.
3. The user submits the long-lived sk_ credential in the conversation.
4. The credential becomes part of session data and may be retained in logs or exposed to systems that process conversation history.
5. An unauthorized party with access to those records recovers the key.
6. The party authenticates to TranscriptOut using the recovered bearer credential.

Impact Assessment

A recovered key can allow unauthorized requests under the user's TranscriptOut account context, including consumption of available credits and access to API resources permitted by that key. The project does not establish access to local operating-system p ...[truncated 121 chars]

Remediation

View remediation

Remediation Suggestions

• Do not request API keys through ordinary chat messages.
• Use the Agent runtime's dedicated secret-input interface, credential broker, or secret manager.
• Ensure the secret value is delivered directly to the runtime environment without entering model context or conversation history.
• Prefer a browser-based authorization flow that returns a narrowly scoped token to a trusted credential store.
• Add explicit instructions prohibiting display, logging, or repetition of the key.
• If manual entry is unavoidable, provide a local out-of-band command or secure prompt that disables echo and bypasses conversational logging.
• Support key revocation and rotation, and advise users to rotate any key previously pasted into a conversation.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/auth-setup.md:60

Finding

Raw Authentication Responses Written to Unspecified Temporary Files

Content

View full analysis

Vulnerability Details

File Location: references/auth-setup.md:60-63
Vulnerability Type: Unsafe temporary-file handling of bearer credentials
Risk Level: Medium

Vulnerable Code

markdown

**Pipe the response into a temporary file and build the next request by reading the token out of
that file. Never echo the token on its own.** Several agent runtimes scrub anything shaped like
`access_token` or a bearer token from tool output before the model sees it, so a printed token
arrives as `[REDACTED]` and the flow dead-ends. File in, file out, one chained command.

The same unsafe handling model is repeated later:

markdown

Same discipline as before: **response into a file, key read out of the file**, because
`sk_`-prefixed values get scrubbed from tool output by the same runtimes.

Technical Analysis

The setup workflow directs the Agent to write complete authentication responses containing a short-lived bearer token or long-lived API key into a temporary file. It does not prescribe secure file creation, an unpredictable path, restrictive permissions, exclusive creation, symlink protection, or guaranteed cleanup on errors and interruptions.

The stated purpose is to bypass runtime redaction of credential-shaped output. Redaction is a security control intended to prevent secrets from reaching model or tool output. Routing raw responses through files expands the number of places where credentials exist and can undermine that protection.

If an implementation uses a predictable filename or permissive default permissions, another local process or user may read the credential. An attacker capable of preparing a symlink at the selected path could potentially redirect secret output to another location. Temporary artifacts may also survive if execution stops before the later deletion instruction.

Attack Path

1. The Agent calls the TranscriptOut registration or verification endpoint.
2. It writes the complete response, including `ac ...[truncated 1036 chars]

Remediation

View remediation

Remediation Suggestions

• Avoid storing complete authentication responses on disk.
• Parse sensitive fields in memory inside a trusted component and pass them directly to the runtime's secret manager.
• Do not design workflows specifically to circumvent runtime secret redaction.
• If disk storage is unavoidable:
  • Create the file with a cryptographically unpredictable name in a private directory.
  • Use exclusive creation and permissions equivalent to 0600.
  • Reject symbolic links and avoid shared or world-readable temporary directories.
  • Set a restrictive umask before file creation.
  • Register failure-safe cleanup before making the network request.
  • Delete the file on success, failure, interruption, and timeout.
  • Write only the minimum required field rather than the complete response body.
• Never emit credentials to standard output, command traces, logs, or shell history.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/auth-setup.md:158

Finding

Unrestricted Persistent Storage of a Long-Lived API Key

Content

View full analysis

Vulnerability Details

File Location: references/auth-setup.md:158-168
Vulnerability Type: Insecure persistent secret storage
Risk Level: Medium

Vulnerable Code

markdown

## Storing the Key

You now have a string that starts with `sk_`. This is the `TRANSCRIPTOUT_API_KEY`.

Store it persistently using whatever method is correct for this environment (which you determined
in Step 0). Make sure it will be available in future sessions, including non-interactive shells,
without any manual sourcing step from the user.

Once stored, verify it is accessible in the current session. If the session needs a reload or
restart to pick up the new value, do that or tell the user to do it.

Delete the temporary files this process created.

Technical Analysis

The Skill requires cross-session persistence but leaves the storage mechanism entirely to the Agent. It does not require an approved secret manager, access-control restrictions, encryption at rest, or separation from shell profiles and general configuration files.

Requiring availability in all future sessions and non-interactive shells can broaden credential exposure beyond what transcript requests require. Depending on the selected mechanism, the key may be placed in a shell startup file, plaintext configuration, process environment, backup, diagnostic output, or repository-adjacent file. These locations may be readable by unrelated processes or accidentally committed and shared.

Playlist operations only require the credential when making requests to the declared TranscriptOut API. Broad, unspecified cross-session exposure exceeds safe minimum privilege compared with narrowly scoped secret injection at invocation time.

Attack Path

1. The Agent obtains a valid TranscriptOut API key.
2. It follows the instruction to make the key available to future sessions and non-interactive shells.
3. In the absence of a required secret-management mechanism, it stores the key in a plaintext profile ...[truncated 810 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the unrestricted persistence instruction with an allowlist of supported secret managers.
• Inject the key only into the Skill process or API request that requires it rather than every future shell.
• Apply least-privilege access controls so unrelated users and processes cannot read the credential.
• Do not store the key in repositories, ordinary configuration files, shell history, or world-readable startup files.
• Encrypt persistent credentials at rest using an operating-system keychain, runtime vault, or equivalent protected facility.
• Define rotation, revocation, expiration, and deletion procedures.
• Validate permissions after storage without printing the secret.
• Document the precise storage location and security properties for each supported runtime.
• If a secure persistence facility is unavailable, require the user to configure the key manually through a trusted out-of-band mechanism instead of silently choosing an insecure fallback.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document tells the agent to determine a persistence mechanism and store TRANSCRIPTOUT_API_KEY so that all future sessions, including non-interactive shells, can access it. Persistent secret installation at the shell/runtime level is highly privileged behavior and is not justified by a playlist helper; if misused, it can expose credentials to other processes, future tasks, or unintended principals on the same machine.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly directs the agent to create or sign into a third-party TranscriptOut account on the user's behalf using email-based OTP flows. That is a sensitive identity action unrelated to the narrow playlist-use case, and it conditions the agent to collect identifiers, trigger login emails, and complete authentication flows that can be abused for unauthorized account access or account lifecycle manipulation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## GET /v1/playlist/videos · 1 credit/page

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.

md

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## GET /v1/playlist/videos · 1 credit/page

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth-setup.md (reported line 54)May include surrounding context.

md

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## GET /v1/playlist/videos · 1 credit/page

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth-setup.md (reported line 102)May include surrounding context.

md

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## GET /v1/playlist/videos · 1 credit/page

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth-setup.md (reported line 176)May include surrounding context.

md

## API Reference

Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs).

## GET /v1/playlist/videos · 1 credit/page

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The example request demonstrates sending playlist data to TranscriptOut, which is a real outbound data flow. Although aligned with the skill's purpose, it remains a confirmed privacy/security concern because the skill does not pair this with an explicit notice about third-party processing of playlist contents.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash

# First page (100 videos)
curl -s "https://api.transcriptout.com/v1/playlist/videos?id=PL_ID_OR_URL" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The example request demonstrates sending playlist data to TranscriptOut, which is a real outbound data flow. Although aligned with the skill's purpose, it remains a confirmed privacy/security concern because the skill does not pair this with an explicit notice about third-party processing of playlist contents.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

bash

# First page (100 videos)
curl -s "https://api.transcriptout.com/v1/playlist/videos?id=PL_ID_OR_URL" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 78% confidence

Finding

Pagination requests continue transmitting playlist-derived tokens and querying an external service, extending the same third-party exposure across multiple pages. The risk is not code execution but unannounced continued disclosure of playlist structure and access patterns to the vendor.

Content

Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.

md

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# Next pages
curl -s "https://api.transcriptout.com/v1/playlist/videos?next_page_token=TOKEN" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# IDs only, 500 per page (feed these into the bulk job)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The ids_only mode is more sensitive in context because it extracts and transmits a bulk list of video IDs specifically for downstream processing. This facilitates large-scale external processing of an entire playlist, which increases privacy exposure if users are unaware that the full playlist membership is being sent off-platform.

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

IDs only, 500 per page (feed these into the bulk job)

curl -s "https://api.transcriptout.com/v1/playlist/videos?id=PL_ID_OR_URL&ids_only=true"
-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

Playlist search sends the playlist reference plus a user query substring to a third party, revealing both content context and what the user is looking for inside the playlist. In many environments this is acceptable functionality, but it should still be treated as external disclosure and explained to the user.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

Find videos inside a playlist by a substring of the title (case-insensitive). YouTube has no native playlist search, so this scans up to 500 playlist items.

bash

curl -s "https://api.transcriptout.com/v1/playlist/search?id=PL_ID_OR_URL&q=QUERY&limit=30" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This workflow step collects all playlist video IDs for later bulk submission, creating a complete externally processable representation of the playlist. The context makes this more dangerous than a single lookup because it scales disclosure from one item to an entire course or series.

Content

Scanner excerpt · SKILL.md (reported line 72)May include surrounding context.

bash

# 1. Collect the playlist's IDs
curl -s "https://api.transcriptout.com/v1/playlist/videos?id=PL_ID&ids_only=true" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# 2. One bulk job for every video

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The bulk transcript POST sends a potentially large set of video IDs to a third-party service for asynchronous processing, which is the clearest instance of external transmission in the skill. This materially increases exposure because it can process up to thousands of videos in one job and may include sensitive educational, internal, or private playlist contents.

Content

Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.

md

-H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

# 2. One bulk job for every video
curl -s -X POST "https://api.transcriptout.com/v1/transcripts" \
  -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"videos":["ID1","ID2","..."],"format":"text"}'

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file is an auth onboarding guide that instructs the agent to obtain, handle, verify, and persist a third-party API key across future sessions, which exceeds the stated playlist/transcript assistance scope. Expanding a content-processing skill into credential provisioning and long-term secret management increases the attack surface and can normalize unsafe secret-handling behavior in agent runtimes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The storage instructions tell the agent to persist the API key and ensure it survives future sessions, but they do not require an explicit warning or consent checkpoint before writing credentials into local environment mechanisms. This can cause users to unknowingly place long-lived secrets into shell profiles or agent config locations where they may be inherited, backed up, or read by other tooling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly requires sending playlist identifiers, search queries, and potentially entire video ID lists to TranscriptOut, but it does not clearly disclose this third-party data transmission to the user at the point of use. That creates a privacy and consent gap: users may provide playlist URLs or course lists without understanding that the contents will be processed by an external service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.