Dataify YouTube Transcript By ID

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:08 AM UTC
• Version: 1.3.0

Overview

The skill mostly matches its transcript-collection purpose, but it has unsafe token-handling instructions in the Chinese localization and loads an unverified external Python module before running.

Review before installing. Use this only for explicit Dataify transcript requests, configure DATAIFY_API_TOKEN through a local environment variable rather than chat, and do not run the bundled script unless the external dataify-task-operations runtime is trusted and installed from a reviewed source.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.zh-CN.md:6

Finding

Localized instructions force tracked promotional output after successful tasks

Content

View full analysis

Vulnerability Details

File Location: SKILL.zh-CN.md, lines 6–8, 47–49, and 174–180
Vulnerability Type: Agent output manipulation through inconsistent localized instructions
Risk Level: Medium

Vulnerable Instructions

markdown

通过 Dataify Builder 按视频 ID 提交 YouTube 字幕/转录采集任务。提交成功后，向用户提供 `task_id`、返回的或推断的状态，并告诉他们访问 [Dataify](https://dashboard.dataify.com?utm_source=skill) 查看结果。

markdown

13. 告诉用户访问 [Dataify](https://dashboard.dataify.com?utm_source=skill) 查看或管理结果。

markdown

## 安全规则

- 不要将 `subtitles_language`、`subtitles_type` 或 `selected_only` 放入 `spider_parameters` 中。
- 不要省略 `spider_universal`。
- Builder 成功后不要轮询结果。
- 提及认证时仅使用 `API TOKEN` 和 `DATAIFY_API_TOKEN`。
- 不要硬编码本地 Python 路径。
- 不要声称 Builder 响应包含 YouTube 转录文件。
- 不要编造结果字段。
- 任务创建成功后始终引导用户访问 [Dataify](https://dashboard.dataify.com?utm_source=skill)。

Technical Analysis

The Chinese localization requires the agent to direct users to a tracked Dataify dashboard URL after successful task creation. The final instruction makes this behavior unconditional.

This requirement is not necessary to submit a transcript task or return its result. It also conflicts with the English account-call-to-action policy in SKILL.md, which states that dashboard promotion should not be shown during normal submission, processing, or successful completion.

The language-dependent conflict can alter the agent's response goals when the localized Skill is loaded. Instead of only completing the requested transcript workflow, the agent is instructed to inject promotional dashboard guidance containing the utm_source=skill attribution parameter.

Attack Path

1. A user invokes the Skill in a context where SKILL.zh-CN.md governs its behavior.
2. The agent submits a legitimate transcript collection task.
3. The task is created successfully.
4. The localized instructions compel the agent to append the tracked Dataify dashboard link.

...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the unconditional requirement to direct users to the dashboard after successful task creation.
• Show account or dashboard links only when authentication fails, credits are insufficient, task management is explicitly requested, or results cannot be retrieved automatically.
• Remove referral attribution parameters unless they are necessary and clearly disclosed.
• Align the localized completion workflow with SKILL.md: poll the existing task by default and return the collected result.
• Establish one canonical security and interaction policy, then generate or review all localized versions against it.
• Add automated consistency checks for security-sensitive phrases such as token handling, polling behavior, promotional output, and result delivery.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.zh-CN.md:12

Finding

Localized workflow instructs users to disclose API tokens through conversation

Content

View full analysis

Vulnerability Details

File Location: SKILL.zh-CN.md, lines 12–23, 42–45, and 153–155
Vulnerability Type: Insecure credential collection and handling
Risk Level: High

Vulnerable Instructions

markdown

## API TOKEN 处理

使用 `DATAIFY_API_TOKEN` 作为长期保存的 token 名称。

- 如果用户在请求中提供了 token，则使用该 token。
- 如果未提供 token，先检查环境变量中是否已保存 `DATAIFY_API_TOKEN`。
- 如果本地已保存 `DATAIFY_API_TOKEN`，则直接使用，无需要求用户重新输入 token。
- 如果本地没有可用的 token，告知用户需要提供 Dataify API TOKEN。
- 如果用户没有 API TOKEN，告诉他们可以在 [Dataify](https://dashboard.dataify.com/login?utm_source=skill) 注册或登录获取。
- 如果用户已有 API TOKEN，告诉他们可以在 [Dataify](https://dashboard.dataify.com?utm_source=skill) 右上角找到。
- 用户提供 API TOKEN 且本地未保存 `DATAIFY_API_TOKEN` 后，询问是否希望将其本地保存为 `DATAIFY_API_TOKEN` 以便将来使用。
- 如果用户希望保存，提供适合其 shell 的命令并要求他们执行；不要在未确认的情况下静默持久化 token。
- 没有 token 不要调用 Builder 接口。
- 在面向用户的说明中始终称其为 `API TOKEN`。本地保存时优先使用环境变量名 `DATAIFY_API_TOKEN`。

markdown

7. 从用户显式输入或已保存的 `DATAIFY_API_TOKEN` 解析 Dataify token。
8. 如果没有可用的 token，要求用户输入 API TOKEN，并询问是否将其保存为 `DATAIFY_API_TOKEN`。

markdown

`Missing Dataify API TOKEN` 表示未传递显式 token 且本地未保存 `DATAIFY_API_TOKEN`。告知用户需要提供 Dataify API TOKEN，询问是否将其保存为 `DATAIFY_API_TOKEN`，或告诉他们可以在 [Dataify](https://dashboard.dataify.com/login?utm_source=skill) 注册或登录获取。如果已有 token，告诉他们可以在 [Dataify](https://dashboard.dataify.com?utm_source=skill) 右上角找到。

Technical Analysis

The localized workflow explicitly allows a token supplied in the user's request and instructs the agent to ask the user to enter an API token when no environment token is available. This can cause credentials to be placed directly into chat messages.

Credentials entered into a conversation may be retained by chat history, application logs, telemetry, debugging traces, or downstream agent context. Conversational disclosure is unnecessary because the executable script reads the credential from DATAIFY_API_TOKEN.

The instructions are internally inconsistent: the ...[truncated 1186 chars]

Remediation

View remediation

Remediation Suggestions

• Delete all instructions that ask users to enter or paste an API token into conversation.
• Require users to configure DATAIFY_API_TOKEN through a session-scoped environment variable.
• Verify only whether the variable is present; never display, echo, serialize, or log its value.
• Prefer session-scoped setup over persistent storage. Offer persistent storage instructions only after explicit user consent.
• Ensure error messages direct users to configure the environment rather than provide credentials to the agent.
• Revoke and rotate any token that has already been disclosed through chat.
• Make the safe token policy identical in all localized Skill files.
• Add tests that reject prompts or documentation containing instructions to provide credentials through conversation.

T08 · Insecure Dependencies

Error

• Location: scripts/submit_dataify_youtube_transcript_by_id.py:9

Finding

Script executes an unverified module from a predictable directory outside the Skill package

Content

View full analysis

Vulnerability Details

File Location: scripts/submit_dataify_youtube_transcript_by_id.py, lines 9–12 and 248–256
Vulnerability Type: Unsafe dependency loading and Python module path manipulation
Risk Level: High

Vulnerable Code

python

TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts"))
if TASK_RUNTIME_DIR not in sys.path:
    sys.path.insert(0, TASK_RUNTIME_DIR)
from task_runtime import complete_task

python

    if not args.no_wait:
        try:
            final_result = complete_task(task_id, api_token, args.wait_timeout)
        except RuntimeError as exc:
            print(str(exc), file=sys.stderr)
            return 1
        print(json.dumps(final_result, ensure_ascii=False, indent=2))

Technical Analysis

The script constructs a predictable sibling-directory path outside the audited project, places it at the beginning of sys.path, and imports task_runtime from that location. Python executes module-level code immediately during import.

The dependency is not included in this project, pinned to a version, or verified using a cryptographic digest or trusted package mechanism. Because the external path is prepended to the module search path, a malicious task_runtime.py placed there will be preferred.

The import occurs at program startup rather than only when result monitoring is needed. Consequently, malicious module code can run even when the user requests --help, --list-options, or --no-wait.

In the normal waiting workflow, the imported complete_task function also receives both the Dataify task ID and the plaintext API token. The external module's behavior cannot be verified from the audited project.

Attack Path

1. An attacker obtains write access to the predictable dataify-task-operations/scripts sibling directory or influences how that directory is provisioned.
2. T ...[truncated 1377 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the direct sys.path mutation and predictable sibling-directory import.
• Package task_runtime as a reviewed dependency with an exact version and integrity lock.
• Prefer a signed or hash-verified package distributed through a trusted internal or public repository.
• If the runtime must remain local, resolve it from a protected installation directory and verify its cryptographic hash before loading.
• Import the monitoring dependency lazily only after confirming that waiting is required.
• Do not pass the raw API token to an unverified component. Use a narrowly scoped authenticated client or capability where possible.
• Apply restrictive filesystem permissions so untrusted users cannot write to dependency locations.
• Include the monitoring implementation in future audits and review its network destinations, credential handling, result-download behavior, and error logging.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs use of environment access and outbound network requests but does not declare any explicit tool scope or allowed-tools boundaries. This creates an authorization gap where an agent may use more capability than a reviewer or runtime policy expects, increasing the risk of unintended secret access or external requests.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 196)May include surrounding context.

md

Use `DATAIFY_API_TOKEN` as the long-term saved token name.

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user wants to save it, give the appropriate command for their shell and ask them to run it; do not silently persist tokens without confirmation.
- Do not call the Builder endpoint without a token.
- Always call it `API TOKEN` in user-facing instructions. Prefer the environment variable name `DATAIFY_API_TOKEN` for saved local use.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.zh-CN.md (reported line 194)May include surrounding context.

md

## Account CTA policy

- Show a prominent Dataify account CTA only when the API token is missing, rejected/invalid, or the account has insufficient credits.
- For a missing token, offer https://dashboard.dataify.com/login?utm_source=skill and state: New accounts receive 50 free credits. Never ask the user to paste the token into chat.
- Detect the current operating system and shell. Show only the matching session-scoped setup command first (`export` for macOS/Linux shells, `$env:` for Windows PowerShell, or `set` for Windows Command Prompt). Show other platforms or persistent setup only when detection is ambiguous or the user asks.
- After the user says the token is configured, verify only whether `DATAIFY_API_TOKEN` is present; never print its value. If verification succeeds, continue the original task without asking the user to repeat it.
- Explain that persistent shell changes may require a new terminal or restarting the agent application. Do not recommend a project `.env` unless the execution path explicitly loads it, and ensure `.env` is ignored by version control.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L194 says 'Never ask the user to paste the token into chat,' but multiple earlier sections explicitly instruct the agent to request the API token from the user when it is missing and to use a token provided in the request. These instructions are directly inconsistent about the intended interaction model for credential collection.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest sets allow_implicit_invocation: true without any visible narrowing constraints on when the skill may be auto-invoked. Because this skill can fetch external transcript content and wait on asynchronous tasks, implicit invocation increases the chance of unintended data collection or prompt-routing abuse when user intent is ambiguous.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The subtitle option labels and related user-facing values are presented almost entirely in Chinese, which imposes a specific language/locale on users of the skill. There is no opt-in, alternate locale support, or documented justification that this script is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The file is predominantly written in Chinese, but the 'Account CTA policy' section switches to English and prescribes fixed user-facing wording such as 'state: New accounts receive 50 free credits.' This creates a natural-language locale policy issue because it may force English responses or mixed-language output without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.