YouTube Model Feeder

• Outcome: Review
• Latest audit: Sep 12, 2026 · 8:06 AM UTC
• Version: 1.0.1

Overview

The skill’s purpose is coherent, but it asks users to run an unpinned external Docker stack and can send extracted video content to cloud LLM providers, so it needs human review before installation.

Install only after reviewing the referenced GitHub repository and Docker Compose configuration, pinning a known commit, and confirming container mounts, exposed ports, credentials, and LLM provider settings. Use the default local Ollama path for sensitive videos unless you intentionally want extracted content sent to OpenAI or Anthropic.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:82

Finding

Unpinned Remote Repository Retrieved and Executed Through Docker Compose

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 82–84
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

Vulnerable Code

bash

git clone https://github.com/celstnblacc/youtube-model-feeder.git
cd youtube-model-feeder
docker-compose up -d

Technical Analysis

The installation procedure clones the mutable default branch of an external Git repository and immediately launches its Docker Compose stack. It does not pin a reviewed commit or release, verify a checksum or cryptographic signature, or pin container images by immutable digest.

Consequently, the effective code executed by users can change after this skill has been reviewed. The audited package contains only SKILL.md; the referenced source code, Compose configuration, Dockerfiles, container entry points, volume mounts, privileges, and image definitions are not included and therefore could not be verified during this audit.

This behavior most closely matches T03: Remote Payload Retrieval and Execution: an external source controls a payload that is retrieved and subsequently executed. Although it also creates supply-chain risk, the direct clone-and-run sequence makes remote payload execution the best matching classification.

Attack Path

1. An attacker compromises the upstream repository, a maintainer account, a build pipeline, or an unpinned container image referenced by the Compose configuration.
2. The attacker modifies the default branch or container image to include malicious startup commands.
3. A user follows the documented installation procedure and clones the current, attacker-controlled repository content.
4. The user runs docker-compose up -d, causing Docker to build, retrieve, and start the altered services.
5. The malicious service executes with the permissions and resources granted by Docker Compose, including any configured networks, environment variables, bind mounts, named volumes, ...[truncated 1104 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the repository to a specific, reviewed commit hash rather than relying on the mutable default branch:

   bash

   git clone https://github.com/celstnblacc/youtube-model-feeder.git
   cd youtube-model-feeder
   git checkout --detach VERIFIED_COMMIT_HASH
   

2. Publish the expected commit hash through a trusted release channel and require users to verify it before execution.
3. Sign releases or commits and document signature verification using a trusted maintainer key.
4. Pin every container image in the Compose file by immutable SHA-256 digest rather than by mutable tags such as latest.
5. Provide checksums or attestations for source archives, images, and generated artifacts. Verify them before starting services.
6. Include the exact reviewed docker-compose.yml, Dockerfiles, and startup scripts in the skill package so their permissions, mounts, ports, and commands can be audited.
7. Apply least privilege to every service: avoid privileged containers, host networking, Docker socket mounts, unnecessary capabilities, host-device access, and writable host bind mounts.
8. Do not pass unrelated host secrets into containers. Use narrowly scoped credentials and explicit secret management.
9. Add a review step between retrieval and execution rather than immediately running the downloaded stack.
10. Document all external network access, exposed ports, filesystem mounts, requested privileges, and data sent to third-party providers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.

bash

# Submit a video for processing
curl -X POST http://localhost:8000/jobs \
  -H "Content-Type: application/json" \
  -d '{"url": "https://youtube.com/watch?v=dQw4w9WgXcQ"}'

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly supports OpenAI and Anthropic for summarization and describes sending extracted content through an LLM pipeline, but it does not prominently warn users that video-derived transcripts, OCR text, screenshots, and slide content may be transmitted to third-party providers. This creates a privacy and data-handling risk because users may process sensitive videos without realizing their contents could leave the local environment.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.