Yt Assemblyai Monitor

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:31 AM UTC
• Version: 1.0.1

Overview

The skill largely matches its YouTube transcription purpose, but it can store and later fetch arbitrary channel URLs, which may let it contact non-YouTube or internal network addresses.

Install only if you are comfortable with YouTube and AssemblyAI cloud processing. Use environment variables for the AssemblyAI key where possible, keep any config file private, and only add real YouTube HTTPS channel URLs until the skill validates channel destinations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/monitor.py:130

Finding

Unrestricted Channel URL Fetch Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:27

Finding

AssemblyAI API Key May Be Stored in an Unprotected Plaintext Configuration File

Content

View full analysis

data/config.json ``` The application then reads the plaintext credential without checking file ownership or permissions: ```python def get_api_key(): key = os.environ.get("ASSEMBLYAI_API_KEY") if key: return key if CONFIG_FILE.exists(): return json.loads(CONFIG_FILE.read_text()).get("api_key") print("ERROR: No API key. Set ASSEMBLYAI_API_KEY or create data/config.json") sys.exit(1) ``` ### Technical Analysis The optional configuration workflow stores a long-lived AssemblyAI API key in plaintext under `data/config.json`. The documented shell redirection relies on ambient directory permissions and the user's `umask`; it does not explicitly create the file with owner-only permissions. The application likewise does not verify that the file is owned by the expected user or inaccessible to group and other accounts. The credential may consequently be exposed to other local users, backup systems, unrelated processes with project access, or source-control commits. The static pre-scan's sensitive network behavior is otherwise consistent with the declared cloud transcription feature: the key is placed in the `authorization` header and sent to the fixed HTTPS AssemblyAI API. The issue is the local storage option rather than evidence of covert credential exfiltration. ### Attack Path 1. A user follows the documented configuration-file setup: ```bash echo '{"api_key": "secret-key"}' > data/config.json ``` 2. The resulting permissions are determined by the environment's `umask` and directory access cont ...[truncated 955 chars]

Remediation

View remediation

data/config.json chmod 600 data/config.json ``` 3. Before reading the file, verify that it is a regular file, owned by the expected user, and has no group or other permission bits. 4. Add `data/config.json` to `.gitignore` and provide a non-sensitive `config.example.json` instead. 5. Avoid printing the API key or including it in exception messages and logs. 6. Document credential rotation procedures for suspected exposure. 7. Use a narrowly scoped API credential where the service supports scope restrictions, usage limits, or separate project keys. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill advertises capabilities that include environment access, file read/write, and network use, but it does not declare any explicit tool scope or permission boundaries. This increases the chance of over-broad execution in agent environments, making unintended data access, filesystem modification, or outbound requests harder to audit and restrict.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The activation guidance is broad enough to match common requests like summarization or monitoring, which can cause the skill to be invoked in situations beyond the user's likely intent. In an agentic system, over-broad routing can expose users to unnecessary network actions, third-party data transfer, or file operations when a simpler local skill would have sufficed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends video-derived audio/transcription content to AssemblyAI, a third-party cloud service, but the markdown lacks a clear upfront warning to users about that transfer. This creates a privacy and consent risk because users may assume processing is local or limited to YouTube fetching, especially given the emphasis on 'pure Python' and 'zero local dependencies.'

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/monitor.py (reported line 25)May include surrounding context.

python

SUMMARIES_DIR = DATA_DIR / "summaries"
CONFIG_FILE = DATA_DIR / "config.json"

API_BASE = "https://api.assemblyai.com/v2"
POLL_INTERVAL = 15
MAX_WAIT = 600

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/monitor.py (reported line 91)May include surrounding context.

python

return None

    body = {"videoId": video_id, "context": ctx}
    resp = requests.post(
        f"https://www.youtube.com/youtubei/v1/player?key={key}",
        json=body,
        headers={

Tainted flow: 'key' from requests.get (line 74, network input) → requests.post (network output)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/monitor.py (reported line 91)May include surrounding context.

python

return None

    body = {"videoId": video_id, "context": ctx}
    resp = requests.post(
        f"https://www.youtube.com/youtubei/v1/player?key={key}",
        json=body,
        headers={

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill sends YouTube-derived audio URLs and resulting transcript processing requests to AssemblyAI, a third-party cloud service, without any explicit consent, disclosure, or policy checks. In a monitoring/transcription skill this is core functionality, but it still creates a real privacy and data-governance risk because potentially sensitive media content is transmitted off-platform.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

This request transmits audio source information to AssemblyAI for cloud transcription and summarization. Because the tool processes potentially sensitive content and sends it to an external processor, the risk is unauthorized disclosure, compliance issues, or user surprise if this transfer is not clearly disclosed and controlled.

Content

Scanner excerpt · scripts/monitor.py (reported line 185)May include surrounding context.

python

"summary_type": "paragraph",
        "summary_model": "conversational",
    }
    resp = requests.post(f"{API_BASE}/transcript", json=payload, headers=headers, timeout=30)
    if resp.status_code != 200:
        print(f"  ERROR submit: {resp.status_code} {resp.text[:200]}")
        return None

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The function loads ASSEMBLYAI_API_KEY from an environment variable or data/config.json, which is sensitive credential material. There is no comment or warning advising users that a secret is being read from local config or environment, nor any note about protecting the config file.

Content

No source excerpt is available for this finding.