Security audit

yt

Security checks for vulnerabilities and agentic risk

Overview

The skill does YouTube lookups as advertised, but its setup flow should be reviewed because it creates and stores a third-party API key with weak safeguards around secret handling.

Install only if you are comfortable using TranscriptOut as the backend service. Prefer creating the account and key yourself, store the key in a dedicated secret manager rather than a shell profile, avoid global non-interactive shell exposure, and delete or rotate the key if it may have been written to logs or temporary files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: references/auth-setup.md:60
Finding: Insecure Temporary Storage and Persistence of Authentication Secrets
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This document instructs the agent to obtain and persist a third-party API credential and even create accounts, which is materially unrelated to the yt skill's stated purpose of quick YouTube lookups. In this context, the skill expands its authority into credential management and long-lived secret installation, creating an unnecessary pathway for secret capture, account manipulation, and persistence on the host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file directs the agent to register users with a third-party service, receive OTPs, exchange them for API keys, and manage long-lived credentials. For a read-oriented YouTube lookup skill, this is unjustified privilege expansion and increases the chance of unauthorized external actions, unintended account provisioning, and sensitive credential handling by the agent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 36)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 92)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/auth-setup.md (reported line 54)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/auth-setup.md (reported line 102)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/auth-setup.md (reported line 176)May include surrounding context.
Fetch the transcript of any YouTube video.

bash
curl -s "https://api.transcriptout.com/v1/transcript?video=VIDEO_URL_OR_ID&format=text" \ -H "Authorization: Bearer $TRANSCRIPTOUT_API_KEY"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The instructions tell the agent to store an API key persistently so future sessions and non-interactive shells can access it, but do not require an explicit warning or consent about writing a sensitive secret into the local environment. Persistent credential installation increases blast radius because the key may become accessible to other tools, future tasks, shell history or profile files, and unintended execution contexts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.