Security audit

YouTube Video

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent YouTube content creation helper, with the main caution that its setup instructions install mutable external CellCog tooling.

Before installing, verify that the CellCog package and skill source are the intended publisher, prefer pinned versions or a reviewed lockfile when possible, and use a CellCog API key with appropriate spending limits because video generation may consume credits.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:227
Finding: Unpinned Third-Party Package Installation
Content: View full analysis
Remediation: View remediation
--hash=sha256: ``` Install it with hash enforcement: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Pin npm or skill sources to an immutable package version or reviewed commit identifier. 4. Remove `-U` from the pip command so installation does not silently upgrade to an unreviewed release. 5. Document the authoritative package registry, publisher identity, and package provenance. 6. Verify available package signatures, attestations, checksums, and software bills of materials before installation. 7. Review package lifecycle hooks, setup scripts, plugin initialization code, and transitive dependencies before approving a new version. 8. Perform installation in an isolated environment with least-privilege filesystem access, restricted credentials, and limited network access. 9. Establish a controlled update process in which new versions are reviewed and tested before the pinned version is changed. ]]>

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (2)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description lists broad capabilities such as 'YouTube videos, Shorts, thumbnails, video scripts, tutorials, vlogs, educational videos, product reviews, video essays' and presents them as general-purpose content creation, but it does not specify concrete trigger phrases, boundaries, or exclusion conditions. For a markdown/manifest-scoped vague-trigger review, this makes activation intent overly broad and could overlap with many common content-creation requests.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 87% confidence
Finding: The skill recommends installing tooling via npx skills add ... without pinning a specific package version. This allows whatever package version is current at execution time to run, increasing supply-chain risk if the package or one of its dependencies is compromised or unexpectedly changed.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.