Security audit
yt-agent
Security checks across malware telemetry and agentic risk
Overview
The skill mostly matches its YouTube summarization purpose, but it can configure use of the user's Chrome cookies without an explicit confirmation step.
Review this before installing if you do not want an agent to configure YouTube access through your Chrome browser profile. The summarization and caching behavior is purpose-aligned, but cookie-backed fetching and unpinned uvx execution are sensitive enough to require user awareness and control.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
VirusTotal findings are pending for this skill version.
Static analysis
No suspicious patterns detected.