youtube-comments-api-skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:01 AM UTC
• Version: 1.0.1

Overview

The skill does what it claims, but it asks users to provide an API key through the agent conversation and sends search topics to BrowserAct, which users should review before installing.

Install only if you are comfortable using BrowserAct for YouTube comment extraction. Configure BROWSERACT_API_KEY through a protected secret or environment setting, not by pasting it into chat. Avoid sensitive search terms, and handle collected commenter names, channel URLs, and comment text according to platform terms and privacy expectations.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:29

Finding

API Key Solicitation Through the Agent Conversation

Content

View full analysis

"Since you have not configured the BrowserAct API Key yet, please go to the [BrowserAct Console](https://www.browseract.com/reception/integrations) first to get your Key." ``` `scripts/youtube_comments_api.py:85-88`: ```python print("Please follow these steps:", flush=True) print("1. Go to: https://www.browseract.com/reception/integrations", flush=True) print("2. Copy your API Key.", flush=True) print("3. Provide it to me or set it as an environment variable (BROWSERACT_API_KEY).", flush=True) ``` ### Technical Analysis The script legitimately requires a BrowserAct API key and supports retrieving it from the `BROWSERACT_API_KEY` environment variable. However, the Skill instructions require the Agent to request the key from the user, while the runtime guidance explicitly suggests providing the credential “to me.” Submitting an API key through an Agent conversation is not necessary for the declared functionality. The key can instead be configured directly in the execution environment. Credentials entered into a conversation may be exposed through chat history, application telemetry, model-provider logs, Agent memory, tool traces, debugging records, or access by other users and administrators who can inspect the session. The script subsequently uses the credential as a Bearer token: ```python headers = {"Authorization": f"Bearer {api_key}"} ``` Transmission of that token to the documented Brow ...[truncated 1619 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description instructs the agent to proactively apply the skill across a very broad set of research, monitoring, sentiment, and competitor-analysis requests. This can cause over-triggering, leading the agent to collect external data and use a privileged API in contexts where the user did not explicitly request YouTube scraping or comment extraction.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment and network capabilities via metadata but does not define an explicit tool scope such as permissions or allowed-tools. That creates an authorization ambiguity where an agent may invoke broader tooling than a reviewer or user expects, increasing the chance of unintended external requests or secret access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The output specification includes commenter names, channel URLs, and comment text, but the skill does not warn about privacy or data-handling implications. In practice, this may encourage bulk collection and redistribution of identifiable user-generated content without informing users about sensitivity, retention, or downstream use risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube_comments_api.py (reported line 15)May include surrounding context.

python

# API Configuration
TEMPLATE_ID = "82165874666051949"
API_BASE_URL = "https://api.browseract.com/v2/workflow"

def run_youtube_comments_task(api_key, keywords, comments_limit=10, scroll_count=2):
    headers = {"Authorization": f"Bearer {api_key}"}

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The script sends user-provided search keywords and a bearer API credential to a third-party service without any explicit consent, warning, or data-handling notice. In an agent skill context, this is risky because users may not realize their prompts or research topics are being transmitted off-platform to BrowserAct, creating privacy and credential-exposure concerns if used with sensitive inputs.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

This POST request transmits user-supplied keywords and the Authorization bearer token to an external API endpoint. While external API use is expected for this skill, the lack of user-facing warning, consent, or input sensitivity checks makes the transmission itself a real privacy/security concern in an agent environment.

Content

Scanner excerpt · scripts/youtube_comments_api.py (reported line 31)May include surrounding context.

python

# 1. Start Task
    print(f"Start Task", flush=True)
    try:
        res = requests.post(f"{API_BASE_URL}/run-task-by-template", json=payload, headers=headers).json()
    except Exception as e:
        print(f"Error: Connection to API failed - {e}", flush=True)
        return None

Static analysis

No suspicious patterns detected.