Security audit

follow-aibuilders

Security checks across malware telemetry and agentic risk

Overview

The skill mostly does what it says, but its optional YouTube cookie path can use local browser session data without enough warning or scoping.

Review before installing if you are not comfortable granting a local summarization skill access to browser cookies. Prefer running it without YT_DLP_COOKIES, or use a dedicated YouTube cookies.txt/service profile if authentication is unavoidable. Keep .env out of source control, restrict file permissions where possible, and trigger digest runs only when you intentionally want network fetching and local state updates.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (5)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The file explicitly instructs operators to configure yt-dlp using browser cookies or a cookies.txt file, which expands the skill’s scope from public-content summarization into access to authenticated browser/session material. Even if intended for legitimate YouTube access, this creates a path for local credential harvesting or overbroad reuse of personal session tokens, which is risky in an agent skill context.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The activation guidance says to use the skill whenever the user wants AI industry insights, builder updates, or '/ai', which is broad enough to trigger on ordinary conversation about AI. Over-broad activation can cause unintended network access, local state changes, or content fetching when the user did not explicitly request this skill's side effects.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The setup command writes a provided API key directly into a project-local .env file without checking file permissions, warning the user, or using a more secure secret store. On shared systems or in accidentally committed working directories, this can expose credentials to other users or source control.

Ssd 3

Medium

Confidence: 86% confidence
Finding: The skill instructs the agent to reveal prompt contents and configuration on request, and the JSON may include internal prompts, source definitions, and user-configured data. Exposing those verbatim can leak operational guidance, customization logic, and potentially sensitive source lists or settings to anyone who can invoke the skill.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Content: 4. 输入 "set up follow builders" 或执行 `/follow-builders` 5. Agent 会以对话方式引导你完成设置设置完成后，你的第一期摘要会立即生成。 ## 修改设置
Confidence: 87% confidence
Finding: The README instructs users to set `YT_DLP_COOKIES=chrome`, which can cause the skill or its tooling to access browser cookies to authenticate scraping. While presented as a convenience feature for yt-dlp, browser-cookie access is sensitive because it can expose authenticated session material and expands the trust boundary to local browser data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/yt-dlp-helpers.js:7

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: scripts/fetch-and-prepare.js:81

Install source points to URL shortener or raw IP.

Warn

Code: suspicious.install_untrusted_source
Location: digest-data.json:13