Youtube Whisper

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:35 AM UTC
• Version: 1.4.1

Overview

The skill appears intended for YouTube transcription, but users should review it because documented media limits are not enforced and the script has local file-handling and dependency risks.

Install only if you are comfortable running local shell tooling that downloads YouTube audio and writes transcript files. Prefer reviewed or pinned versions of yt-dlp, ffmpeg, and openai-whisper, avoid running it on untrusted or very long media, and watch output paths because existing files may be overwritten.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81
• Finding: Unpinned Third-Party Dependencies Create a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:81-84`; also documented in `README.md:71-79` and `README.md:165-173` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```markdown ## Requirements - yt-dlp: `brew install yt-dlp` - Whisper: `pip3 install openai-whisper` - ffmpeg: `brew install ffmpeg` ``` The README additionally recommends: ```bash brew install yt-dlp ffmpeg pip3 install openai-whisper clawhub install openai-whisper ``` ### Technical Analysis The installation instructions retrieve mutable third-party packages without pinning versions, hashes, package sources, or a reviewed ClawHub skill release. The code ultimately executes `yt-dlp`, `ffmpeg`, and `whisper`, so the integrity of these dependencies directly affects the integrity of the skill. Package managers normally install the latest release that satisfies an unpinned request. If a package publisher account, registry entry, distribution channel, or referenced ClawHub skill is compromised, later installations could retrieve code different from the version reviewed during this audit. Python packages may also execute build or installation logic during installation. ### Attack Path 1. An attacker compromises a referenced package publisher, package registry entry, distribution channel, or mutable ClawHub skill release. 2. The attacker publishes a malicious update under the expected dependency name. 3. A user follows the documented unpinned installation command. 4. The package manager downloads and installs the attacker-controlled version. 5. Malicious installation logic or substituted command-line tools execute under the user's account when installed or invoked by the skill. ### Impact Assessment Successful exploitation can provide arbitrary code execution with the privileges of the user performing the installation or running the skill. This may expose files, environment ...[truncated 209 chars]
• Remediation: ## Remediation Suggestions - Pin every dependency to a reviewed version rather than requesting the latest release. - For Python dependencies, use a lock file or requirements file with cryptographic hashes, such as `pip install --require-hashes -r requirements.txt`. - Pin the referenced ClawHub skill version where the package manager supports version constraints. - Document the expected package registry and trusted distribution source. - Verify downloaded artifacts through checksums or package signatures where available. - Periodically review and deliberately update pinned versions after security and compatibility testing. - Avoid recommending privileged installation unless strictly necessary.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/youtube-whisper.sh:171
• Finding: Predictable Temporary Directory Permits Local File Manipulation## Vulnerability Details **File Location**: `scripts/youtube-whisper.sh:171-178` **Vulnerability Type**: Predictable and insufficiently validated temporary directory **Risk Level**: Medium ### Vulnerable Code ```bash echo "📥 正在下載 YouTube 影片..." TEMP_DIR="/tmp/youtube-whisper-$$" AUDIO_FILE="$TEMP_DIR/audio.m4a" mkdir -p "$TEMP_DIR" # 清理函式 / Cleanup function cleanup() { rm -rf "$TEMP_DIR" } ``` ### Technical Analysis The temporary directory name is derived only from the process ID and is therefore predictable. `mkdir -p` does not fail when the target directory already exists, and the script does not verify that it created the directory, that the current user owns it, or that files inside it are not symbolic links. On a shared system, another local user who can predict or observe the process ID may create the directory before the script does. Subsequent `yt-dlp`, Whisper, transcript discovery, copy, and cleanup operations then occur in an attacker-prepared directory. The quoted variables prevent shell word splitting, but they do not address pre-creation, ownership, or symbolic-link attacks. ### Attack Path 1. A local attacker predicts a likely process ID for the victim's script invocation. 2. The attacker pre-creates `/tmp/youtube-whisper-<PID>` before the victim reaches `mkdir -p`. 3. The victim runs the skill, and `mkdir -p` accepts the attacker's existing directory. 4. The attacker places crafted files or links in that directory, such as a pre-existing transcript file that may be selected by: ```bash TRANSCRIPT_FILE=$(ls "$TEMP_DIR"/*.txt 2>/dev/null | head -1) ``` 5. The script processes or copies attacker-controlled content, or encounters attacker-controlled file-system behavior during download and cleanup. Exploitation requires local access and successful timing or process-ID prediction. ### Impact Assessment The primary impact is manipulation of temporary audio or ...[truncated 349 chars]
• Remediation: ## Remediation Suggestions - Create the directory atomically with `mktemp -d`, for example: ```bash TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/youtube-whisper.XXXXXXXX") || { echo "Failed to create temporary directory" >&2; exit 1; } chmod 700 "$TEMP_DIR" ``` - Set a restrictive `umask`, such as `umask 077`, before creating temporary files. - Register the cleanup trap immediately after successful directory creation. - Reject unexpected symbolic links and pre-existing output files inside the temporary directory. - Avoid parsing `ls`; construct the expected Whisper output path or use a safe shell glob with explicit validation. - Retain quoted variables in all file operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/youtube-whisper.sh:35
• Finding: Documented Media Resource Limits Are Not Enforced## Vulnerability Details **File Location**: `scripts/youtube-whisper.sh:35-37` and `scripts/youtube-whisper.sh:181` **Vulnerability Type**: Missing download and processing resource controls **Risk Level**: Medium ### Vulnerable Code The script declares limits but never uses them: ```bash # 影片限制 / Video limits MAX_DURATION_MINUTES=30 MAX_FILESIZE_GB=1 ``` The audio download proceeds without a duration, size, or execution-time restriction: ```bash yt-dlp -f "bestaudio[ext=m4a]" -o "$AUDIO_FILE" "$url" --quiet 2>/dev/null ``` The README states that a 30-minute duration limit, a 1 GB file-size limit, and automatic checks are provided, but no corresponding enforcement exists in the executable script. ### Technical Analysis Merely declaring limit constants does not enforce them. Neither `MAX_DURATION_MINUTES` nor `MAX_FILESIZE_GB` is referenced after assignment. The script does not inspect media metadata before download, impose a `yt-dlp` maximum file size, limit network transfer time, verify free disk space, or impose a timeout on Whisper processing. An attacker or untrusted user can therefore supply a valid media URL referencing unusually long or large content. Download and transcription may continue until the content completes or host resources are exhausted. The RAM check does not mitigate disk exhaustion, prolonged CPU usage, or unrestricted download duration. ### Attack Path 1. An attacker supplies a URL for an exceptionally long or large media item. 2. An agent or user invokes the skill while relying on the documented automatic limits. 3. The script checks system memory but does not query or validate media duration or expected download size. 4. `yt-dlp` downloads the unrestricted audio stream. 5. Whisper attempts to process the resulting file without a timeout. 6. Disk capacity, CPU time, memory, or agent execution capacity is consumed, potentially disrupting other workloads. ### Impact Assessme ...[truncated 376 chars]
• Remediation: ## Remediation Suggestions - Query media metadata with `yt-dlp --dump-single-json` before downloading. - Parse and validate the reported duration and estimated file size against the configured limits. - Reject over-limit or unavailable metadata by default; require explicit, trusted confirmation for an override. - Apply `yt-dlp` download constraints such as a maximum file-size policy where supported. - Check available disk space before download and while processing. - Run both download and transcription commands under explicit timeouts. - Apply process-level CPU, memory, and file-size limits where the operating system supports them. - Clean up partial downloads on every failure and signal path. - Update the README if automatic enforcement is not implemented so that documentation accurately reflects actual behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The usage triggers "give me text" and "summarize" are broad natural-language phrases that can easily appear in ordinary conversation, making accidental invocation plausible. In an agent skill context, overly generic triggers can cause the agent to download and process external content when the user did not clearly intend to invoke this specific skill.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: Declaring Traditional Chinese as the default output language without explicit user choice can lead to unexpected transcription behavior, especially for multilingual or English-speaking users. While not a code-execution risk, it can cause integrity and usability issues by returning output in a language or script the user did not request.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The Chinese documentation repeats that Traditional Chinese is the default output, again without clear opt-in or language selection. In agent workflows, implicit language defaults can produce misleading or undesired results and reduce user control over generated content.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The description states that the skill will convert videos into Chinese/English subtitles, which implies a preset language/output behavior rather than explicit user choice. Forcing or implying a language transformation without opt-in can produce unintended disclosure, mistranslation, or undesired content processing, especially for multilingual or sensitive material.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill explicitly downloads and processes external YouTube content, but the description does not warn users about fetching third-party media, potential copyright/privacy concerns, or the resource/network impact of doing so. This omission can mislead users into invoking the skill without informed consent about external content handling and local system effects.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The Whisper command hard-codes `--language zh`, which imposes a specific language setting regardless of the video's actual language or user preference. This is a natural-language policy concern because the skill forces a locale/language choice without offering opt-in, selection, or clear justification.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: This code copies the generated transcript into the final output path, which is a file write affecting user data on disk. Although the script logs completion, it does not disclose before execution that it will create or overwrite the specified output file, and there is no confirmation prompt or overwrite warning.

Static analysis

No suspicious patterns detected.