Youtube Whisper

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:35 AM UTC
• Version: 1.4.1

Overview

The skill appears intended for YouTube transcription, but users should review it because documented media limits are not enforced and the script has local file-handling and dependency risks.

Install only if you are comfortable running local shell tooling that downloads YouTube audio and writes transcript files. Prefer reviewed or pinned versions of yt-dlp, ffmpeg, and openai-whisper, avoid running it on untrusted or very long media, and watch output paths because existing files may be overwritten.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:81

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:81-84; also documented in README.md:71-79 and README.md:165-173
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

## Requirements

- yt-dlp: `brew install yt-dlp`
- Whisper: `pip3 install openai-whisper`
- ffmpeg: `brew install ffmpeg`

The README additionally recommends:

bash

brew install yt-dlp ffmpeg
pip3 install openai-whisper
clawhub install openai-whisper

Technical Analysis

The installation instructions retrieve mutable third-party packages without pinning versions, hashes, package sources, or a reviewed ClawHub skill release. The code ultimately executes yt-dlp, ffmpeg, and whisper, so the integrity of these dependencies directly affects the integrity of the skill.

Package managers normally install the latest release that satisfies an unpinned request. If a package publisher account, registry entry, distribution channel, or referenced ClawHub skill is compromised, later installations could retrieve code different from the version reviewed during this audit. Python packages may also execute build or installation logic during installation.

Attack Path

1. An attacker compromises a referenced package publisher, package registry entry, distribution channel, or mutable ClawHub skill release.
2. The attacker publishes a malicious update under the expected dependency name.
3. A user follows the documented unpinned installation command.
4. The package manager downloads and installs the attacker-controlled version.
5. Malicious installation logic or substituted command-line tools execute under the user's account when installed or invoked by the skill.

Impact Assessment

Successful exploitation can provide arbitrary code execution with the privileges of the user performing the installation or running the skill. This may expose files, environment ...[truncated 209 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every dependency to a reviewed version rather than requesting the latest release.
• For Python dependencies, use a lock file or requirements file with cryptographic hashes, such as pip install --require-hashes -r requirements.txt.
• Pin the referenced ClawHub skill version where the package manager supports version constraints.
• Document the expected package registry and trusted distribution source.
• Verify downloaded artifacts through checksums or package signatures where available.
• Periodically review and deliberately update pinned versions after security and compatibility testing.
• Avoid recommending privileged installation unless strictly necessary.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/youtube-whisper.sh:171

Finding

Predictable Temporary Directory Permits Local File Manipulation

Content

View full analysis

Vulnerability Details

File Location: scripts/youtube-whisper.sh:171-178
Vulnerability Type: Predictable and insufficiently validated temporary directory
Risk Level: Medium

Vulnerable Code

bash

echo "📥 正在下載 YouTube 影片..."
TEMP_DIR="/tmp/youtube-whisper-$$"
AUDIO_FILE="$TEMP_DIR/audio.m4a"
mkdir -p "$TEMP_DIR"

# 清理函式 / Cleanup function
cleanup() {
    rm -rf "$TEMP_DIR"
}

Technical Analysis

The temporary directory name is derived only from the process ID and is therefore predictable. mkdir -p does not fail when the target directory already exists, and the script does not verify that it created the directory, that the current user owns it, or that files inside it are not symbolic links.

On a shared system, another local user who can predict or observe the process ID may create the directory before the script does. Subsequent yt-dlp, Whisper, transcript discovery, copy, and cleanup operations then occur in an attacker-prepared directory.

The quoted variables prevent shell word splitting, but they do not address pre-creation, ownership, or symbolic-link attacks.

Attack Path

1. A local attacker predicts a likely process ID for the victim's script invocation.
2. The attacker pre-creates /tmp/youtube-whisper-<PID> before the victim reaches mkdir -p.
3. The victim runs the skill, and mkdir -p accepts the attacker's existing directory.
4. The attacker places crafted files or links in that directory, such as a pre-existing transcript file that may be selected by:

   bash

   TRANSCRIPT_FILE=$(ls "$TEMP_DIR"/*.txt 2>/dev/null | head -1)
   

5. The script processes or copies attacker-controlled content, or encounters attacker-controlled file-system behavior during download and cleanup.

Exploitation requires local access and successful timing or process-ID prediction.

Impact Assessment

The primary impact is manipulation of temporary audio or ...[truncated 349 chars]

Remediation

View remediation

Remediation Suggestions

• Create the directory atomically with mktemp -d, for example:

  bash

  TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/youtube-whisper.XXXXXXXX") ||
      { echo "Failed to create temporary directory" >&2; exit 1; }
  chmod 700 "$TEMP_DIR"
  

• Set a restrictive umask, such as umask 077, before creating temporary files.
• Register the cleanup trap immediately after successful directory creation.
• Reject unexpected symbolic links and pre-existing output files inside the temporary directory.
• Avoid parsing ls; construct the expected Whisper output path or use a safe shell glob with explicit validation.
• Retain quoted variables in all file operations.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/youtube-whisper.sh:35

Finding

Documented Media Resource Limits Are Not Enforced

Content

View full analysis

Vulnerability Details

File Location: scripts/youtube-whisper.sh:35-37 and scripts/youtube-whisper.sh:181
Vulnerability Type: Missing download and processing resource controls
Risk Level: Medium

Vulnerable Code

The script declares limits but never uses them:

bash

# 影片限制 / Video limits
MAX_DURATION_MINUTES=30
MAX_FILESIZE_GB=1

The audio download proceeds without a duration, size, or execution-time restriction:

bash

yt-dlp -f "bestaudio[ext=m4a]" -o "$AUDIO_FILE" "$url" --quiet 2>/dev/null

The README states that a 30-minute duration limit, a 1 GB file-size limit, and automatic checks are provided, but no corresponding enforcement exists in the executable script.

Technical Analysis

Merely declaring limit constants does not enforce them. Neither MAX_DURATION_MINUTES nor MAX_FILESIZE_GB is referenced after assignment. The script does not inspect media metadata before download, impose a yt-dlp maximum file size, limit network transfer time, verify free disk space, or impose a timeout on Whisper processing.

An attacker or untrusted user can therefore supply a valid media URL referencing unusually long or large content. Download and transcription may continue until the content completes or host resources are exhausted. The RAM check does not mitigate disk exhaustion, prolonged CPU usage, or unrestricted download duration.

Attack Path

1. An attacker supplies a URL for an exceptionally long or large media item.
2. An agent or user invokes the skill while relying on the documented automatic limits.
3. The script checks system memory but does not query or validate media duration or expected download size.
4. yt-dlp downloads the unrestricted audio stream.
5. Whisper attempts to process the resulting file without a timeout.
6. Disk capacity, CPU time, memory, or agent execution capacity is consumed, potentially disrupting other workloads.

Impact Assessme

...[truncated 376 chars]

Remediation

View remediation

Remediation Suggestions

• Query media metadata with yt-dlp --dump-single-json before downloading.
• Parse and validate the reported duration and estimated file size against the configured limits.
• Reject over-limit or unavailable metadata by default; require explicit, trusted confirmation for an override.
• Apply yt-dlp download constraints such as a maximum file-size policy where supported.
• Check available disk space before download and while processing.
• Run both download and transcription commands under explicit timeouts.
• Apply process-level CPU, memory, and file-size limits where the operating system supports them.
• Clean up partial downloads on every failure and signal path.
• Update the README if automatic enforcement is not implemented so that documentation accurately reflects actual behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The usage triggers "give me text" and "summarize" are broad natural-language phrases that can easily appear in ordinary conversation, making accidental invocation plausible. In an agent skill context, overly generic triggers can cause the agent to download and process external content when the user did not clearly intend to invoke this specific skill.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Declaring Traditional Chinese as the default output language without explicit user choice can lead to unexpected transcription behavior, especially for multilingual or English-speaking users. While not a code-execution risk, it can cause integrity and usability issues by returning output in a language or script the user did not request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The Chinese documentation repeats that Traditional Chinese is the default output, again without clear opt-in or language selection. In agent workflows, implicit language defaults can produce misleading or undesired results and reduce user control over generated content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description states that the skill will convert videos into Chinese/English subtitles, which implies a preset language/output behavior rather than explicit user choice. Forcing or implying a language transformation without opt-in can produce unintended disclosure, mistranslation, or undesired content processing, especially for multilingual or sensitive material.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill explicitly downloads and processes external YouTube content, but the description does not warn users about fetching third-party media, potential copyright/privacy concerns, or the resource/network impact of doing so. This omission can mislead users into invoking the skill without informed consent about external content handling and local system effects.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The Whisper command hard-codes --language zh, which imposes a specific language setting regardless of the video's actual language or user preference. This is a natural-language policy concern because the skill forces a locale/language choice without offering opt-in, selection, or clear justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

This code copies the generated transcript into the final output path, which is a file write affecting user data on disk. Although the script logs completion, it does not disclose before execution that it will create or overwrite the specified output file, and there is no confirmation prompt or overwrite warning.

Content

No source excerpt is available for this finding.