Security audit

yt

Security checks across malware telemetry and agentic risk

Overview

This YouTube lookup skill is useful on its face, but its setup instructions ask the agent to handle and persist authentication secrets in ways users should review before installing.

Install only if you are comfortable giving this skill a TranscriptOut API key and letting your agent store it persistently. Prefer creating the TranscriptOut account and API key yourself in the provider dashboard, use a scoped secret manager if available, avoid pasting reusable secrets into chat, and remove the key when you no longer need the skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This file is materially out of scope for a YouTube lookup skill: it instructs the agent to obtain third-party TranscriptOut credentials, sign users up for accounts, and persist secrets across sessions. That capability expansion is dangerous because it authorizes secret handling and account actions unrelated to the declared skill purpose, increasing the chance of credential misuse, prompt-injection abuse, or unauthorized persistence of sensitive data.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The instructions explicitly tell the agent to create third-party accounts on the user's behalf and to store resulting API keys persistently, which exceeds what a YouTube lookup tool should do. In context, this creates unjustified authority to collect emails, OTPs, bearer tokens, and API keys, broadening the attack surface and enabling abuse of the agent as a credential broker.

Missing User Warnings

Low

Confidence: 94% confidence
Finding: The skill explicitly instructs agents to send user-supplied YouTube URLs, video IDs, channel names, handles, and search queries to a third-party service, but it does not include a clear user-facing privacy warning at the point of use. While this is expected for the skill’s functionality and there is no evidence of hidden exfiltration, users may unknowingly disclose their interests or linked content to an external provider.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The skill asks the user to paste an API key directly into chat without any warning about the sensitivity of credentials or safer input alternatives. That increases the likelihood of accidental exposure in chat history, logs, analytics pipelines, or to downstream tools, especially because the same file also normalizes persistent storage of the supplied key.

Ssd 3

High

Confidence: 98% confidence
Finding: These instructions direct the agent to solicit user API keys and one-time login codes, both of which are authentication secrets, and then continue into storage and verification workflows. Collecting such secrets inside a low-scope YouTube lookup skill is dangerous because it enables credential interception, replay, account takeover assistance, and improper retention of authentication material.

Ssd 3

High

Confidence: 99% confidence
Finding: The guidance tells the agent to write access tokens to temporary files and then read them back to construct later requests. Storing bearer tokens and API keys in temp files creates a local secret exposure risk through filesystem access, crash artifacts, backups, or incomplete cleanup, and it normalizes bypassing redaction controls that were likely intended to reduce secret leakage.

Ssd 3

High

Confidence: 99% confidence
Finding: The file instructs persistent storage of the user's API key so that it is available in all future sessions and non-interactive shells. That is dangerous because it expands the lifetime and reach of a secret beyond the immediate task, making compromise more likely and potentially exposing the key to unrelated processes, later prompts, or other skills running in the same environment.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.