Security audit
tube-summary
Security checks across malware telemetry and agentic risk
Overview
This skill does what it claims: it searches YouTube, downloads subtitles when directed, and locally summarizes subtitle text without hidden persistence or credential access.
Install only if you are comfortable with the skill contacting YouTube and using yt-dlp to create subtitle files in the directory where it runs. Use a normal non-privileged working folder and review any third-party package installs such as yt-dlp, requests, and bs4 before use.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.