Security audit

YouTube Search

Security checks for vulnerabilities and agentic risk

Overview

The skill’s YouTube search function is coherent, but its setup asks the agent to handle account signup, one-time codes, API keys, temporary credential files, and persistent environment changes in ways that need careful review.

Review before installing. The search API use itself is disclosed, but the setup flow may expose a TranscriptOut API key or one-time login code in chat or local files and may persist the key broadly for future sessions. Prefer creating the account and API key yourself, storing it only in a secure secret manager, and avoiding plaintext shell profiles or pasted credentials in normal chat.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: references/auth-setup.md:60
Finding: Unsafe Temporary Storage of Authentication Tokens and API Keys
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/auth-setup.md:162
Finding: Persistent API-Key Storage Is Required Without Adequate Security Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (17)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This file is functionally unrelated to a YouTube search skill and instead instructs the agent to provision TranscriptOut accounts and API credentials. That scope mismatch is dangerous because it grants the skill authority to collect secrets, create third-party accounts, and alter persistent authentication state without a legitimate need tied to the declared capability.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The instructions explicitly ask users to paste API keys and, elsewhere in the flow, one-time login codes into the conversation for processing and storage. Credentials and OTPs in chat are highly sensitive authentication factors; their exposure can enable account takeover, unauthorized API use, and replay before expiration.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file directs the agent to create TranscriptOut accounts on behalf of users via email registration and OTP verification, which is outside the declared YouTube-search scope. This is dangerous because it normalizes delegated identity actions and credential issuance through the agent, creating opportunities for account misuse, consent confusion, and unintended third-party access.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The browser fallback instructs the user to immediately paste a newly created API key into the conversation. This unnecessarily exposes a long-lived credential in chat logs and broadens the risk of leakage to the model context, audit systems, or downstream tools.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions tell the agent to persistently store a third-party API key and manage its availability across future sessions, which exceeds what a YouTube search skill should do. Persistent secret installation increases the blast radius of compromise because the credential may be reused later by unrelated tasks or other skills without the user's informed intent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/search · 1 credit/page

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
md
## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/search · 1 credit/page

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/search · 1 credit/page

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/search · 1 credit/page

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/search · 1 credit/page

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.
md
## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/search · 1 credit/page

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
## API Reference Base URL: `https://api.transcriptout.com/v1`. Full reference with the latest parameters and schemas: [transcriptout.com/docs](https://transcriptout.com/docs). ## GET /v1/search · 1 credit/page

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill instructs the agent to ask the user to paste an API key into chat and then handle/store it, but does not warn that chat and tool traces may retain sensitive values. Asking for secrets in normal conversation channels increases the chance of accidental logging, exposure to other tools, or later retrieval from transcript history.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 88% confidence
Finding: This step sends user email data to an external service endpoint to register a TranscriptOut account. External transmission is expected for account creation, but in this skill context it is unjustified and therefore risky because it shares user data with a third party unrelated to the declared YouTube-search purpose.
Content: Scanner excerpt · references/auth-setup.md (reported line 54)May include surrounding context.
Make a POST request to:

text
POST https://api.transcriptout.com/auth/register-cli Content-Type: application/json { "email": "the_user_email" }

External Transmission

Medium

Category: Data Exfiltration
Confidence: 93% confidence
Finding: This request transmits a bearer access token and OTP-derived verification data to an external service, directly participating in an authentication ceremony. In the context of a YouTube-search skill, this is especially dangerous because it enables the agent to handle live authentication material for an unrelated service.
Content: Scanner excerpt · references/auth-setup.md (reported line 102)May include surrounding context.
Once the user gives you the code, make a POST request to:

text
POST https://api.transcriptout.com/auth/verify-cli Authorization: Bearer <the access_token from Step B-2> Content-Type: application/json

External Transmission

Medium

Category: Data Exfiltration
Confidence: 84% confidence
Finding: This verification call sends the stored API key to a third-party endpoint to confirm validity and credits. While technically normal for API validation, it is risky here because it operationalizes a persisted secret that the skill had no legitimate reason to collect in the first place.
Content: Scanner excerpt · references/auth-setup.md (reported line 176)May include surrounding context.
One free call confirms both the key and the balance (/auth/* endpoints never spend credits):

bash
curl -s https://api.transcriptout.com/auth/me \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill sends user search queries and selected video identifiers to TranscriptOut, a third-party network service, but the user-facing description/setup text does not clearly disclose that data leaves the local environment. This is a real privacy/transparency issue because users may unknowingly transmit sensitive research topics or identifiers to an external provider.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.