Security audit

Youtube To Ebook

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its YouTube-to-ebook purpose, but it needs Review because it can use stored credentials for external email and scheduled local automation without clear enough scoping.

Install only if you are comfortable giving this skill API keys and, if email is enabled, a Gmail app password. Use an isolated environment, keep .env private, review or disable any launchd scheduling, pin dependencies, and inspect generated newsletters before relying on emailed HTML/EPUB output.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

Location: requirements.txt:1
Finding: Unpinned Third-Party Dependencies Create Supply-Chain Exposure
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: write_articles.py:20
Finding: Untrusted YouTube Content Is Embedded Directly into LLM Instructions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: send_email.py:81
Finding: Generated and Externally Controlled Content Is Written to HTML and EPUB Without Sanitization
Content: View full analysis

This article is based on the video "{article['title']}" from the YouTube channel {article['channel']}.

{article_html}
Watch the original video: {article['url']}
""" ``` `send_email.py:235-247`: ```python for article in articles: # Convert markdown article to HTML article_html = markdown.markdown(article['article']) html += f"""

This article is based on the video "{article['title']}" from the YouTube channel {article['channel']}.

{article_html}
Watch the original video
""" ``` ### Technical Analysis The application converts AI-generated Markdown into HTML with `markdown.markdown()` and interpolates video titles, channel names, and URLs directly into HTML templates. Markdown conversion formats content but is not an HTML security sanitizer. The code does not escape metadata, remove raw HTML, filter event-handler attributes, restrict remote resources, or enforce an allowlist of safe elements and URL schemes. The data originates from externally controlled YouTube content and an LLM s ...[truncated 1668 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (64)

Tainted flow: 'SUPADATA_API_KEY' from os.getenv (line 14, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · get_transcripts.py (reported line 42)May include surrounding context.
python
# Make the API request to Supadata # The 'text' format gives us just the plain text (no timestamps) response = requests.get( SUPADATA_TRANSCRIPT_URL, params={ "url": youtube_url,

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 25)May include surrounding context.

Set up API keys:
bash
cp .env.example .env # Edit .env with your keys

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill includes Gmail/SMTP credential use, local archival of generated content and metadata, and external delivery, but the headline description does not make those sensitive behaviors prominent. This increases the risk of users exposing credentials or unintentionally transmitting generated material outside the local environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The skill includes Gmail/SMTP credential use, local archival of generated content and metadata, and external delivery, but the headline description does not make those sensitive behaviors prominent. This increases the risk of users exposing credentials or unintentionally transmitting generated material outside the local environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The skill includes Gmail/SMTP credential use, local archival of generated content and metadata, and external delivery, but the headline description does not make those sensitive behaviors prominent. This increases the risk of users exposing credentials or unintentionally transmitting generated material outside the local environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill includes Gmail/SMTP credential use, local archival of generated content and metadata, and external delivery, but the headline description does not make those sensitive behaviors prominent. This increases the risk of users exposing credentials or unintentionally transmitting generated material outside the local environment.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill includes Gmail/SMTP credential use, local archival of generated content and metadata, and external delivery, but the headline description does not make those sensitive behaviors prominent. This increases the risk of users exposing credentials or unintentionally transmitting generated material outside the local environment.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The skill explicitly relies on a .env file containing API keys and possibly Gmail credentials, indicating access to sensitive secrets. In a skill that also performs file operations, email sending, and external API calls, secret exposure or misuse could lead to account compromise, unauthorized API usage, or data exfiltration.
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
├── send_email.py # Create EPUB & send ├── main.py # Run full pipeline ├── channels.txt # Your channel list └── .env # API keys

text
## Known Pitfalls & Solutions

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code targets a LaunchAgents plist in the user's home directory, establishing or controlling persistent execution on macOS. For a skill described as converting YouTube videos to ebook articles, host-level persistence is not necessary and materially raises the security risk if the skill is installed or modified by an untrusted party.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Executing local programs from the dashboard increases the trust boundary of the UI and can chain into broader behavior performed by main.py. In this skill context, that is more dangerous because the advertised purpose understates that pressing a button launches a local automation pipeline that may fetch content, invoke AI tooling, and send email.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 26)May include surrounding context.
md
from googleapiclient.discovery import build from dotenv import load_dotenv # Load your secret API key from the .env file load_dotenv() YOUTUBE_API_KEY = os.getenv("YOUTUBE_API_KEY")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 116)May include surrounding context.
md
from googleapiclient.discovery import build from dotenv import load_dotenv # Load your secret API key from the .env file load_dotenv() YOUTUBE_API_KEY = os.getenv("YOUTUBE_API_KEY")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · get_transcripts.py (reported line 12)May include surrounding context.
python
from googleapiclient.discovery import build from dotenv import load_dotenv # Load your secret API key from the .env file load_dotenv() YOUTUBE_API_KEY = os.getenv("YOUTUBE_API_KEY")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · get_transcripts.py (reported line 33)May include surrounding context.
python
from googleapiclient.discovery import build from dotenv import load_dotenv # Load your secret API key from the .env file load_dotenv() YOUTUBE_API_KEY = os.getenv("YOUTUBE_API_KEY")

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · get_videos.py (reported line 12)May include surrounding context.
python
from googleapiclient.discovery import build from dotenv import load_dotenv # Load your secret API key from the .env file load_dotenv() YOUTUBE_API_KEY = os.getenv("YOUTUBE_API_KEY")

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 68)May include surrounding context.
Run automatically every week:

bash
# Copy the plist to LaunchAgents cp com.youtube.newsletter.plist ~/Library/LaunchAgents/ # Load it

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 69)May include surrounding context.
Run automatically every week:

bash
# Copy the plist to LaunchAgents cp com.youtube.newsletter.plist ~/Library/LaunchAgents/ # Load it

Session Persistence

Medium

Category: Rogue Agent
Confidence: 75% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 72)May include surrounding context.
Run automatically every week:

bash
# Copy the plist to LaunchAgents cp com.youtube.newsletter.plist ~/Library/LaunchAgents/ # Load it

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill documents behavior that requires network access, filesystem access, shell execution, and environment-secret use, but it does not declare any explicit tool scope or permissions. This creates an unsafe trust boundary because users and reviewers cannot easily tell what capabilities will be exercised, especially given handling of API keys and local automation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation phrase "Set up YouTube to ebook for me" is broad enough that it could be triggered during normal conversation or vague assistant requests. Unintended activation can lead to unnecessary setup actions, requests for credentials, or filesystem changes without clear user intent.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The guidance to install a LaunchAgent plist establishes recurring execution on the user's Mac, which is a persistence mechanism. Even if presented for benign automation, persistence increases risk because the workflow will continue running and accessing files, network resources, and credentials after initial setup.
Content: Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.
Solution: Run automation locally on your Mac using launchd:

xml
 <plist version="1.0"> <dict> <key>Label</key>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The LaunchAgent example continues to define a persistent job label for periodic execution, reinforcing that the skill supports session persistence. Persistence is sensitive in the context of credentialed network automation because it can keep transmitting or processing data long after the user forgets it is enabled.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
Solution: Run automation locally on your Mac using launchd:

xml
 <plist version="1.0"> <dict> <key>Label</key> <string>com.youtube.ebook</string>

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The closing plist snippet completes a persistent launchd configuration that runs on a schedule. In context, this is not inherently malicious, but it is a real persistence capability that deserves elevated scrutiny because it automates future execution with access to content, secrets, and outbound communication.
Content: Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.
7

text
## Customization

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill asks users to place Gmail credentials in a .env file for outbound email, but it does not prominently warn about secret handling, local storage risk, or external transmission of generated content. This can cause users to expose sensitive credentials or send data off-device without appreciating the security implications.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module implements newsletter sending and scheduling management rather than just YouTube-to-ebook/article conversion. This scope expansion increases risk because users may grant trust based on the skill description while the code also manages persistence and outbound automation on the host.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: write_articles.py:15