YouTube Intelligence Extractor

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.1.0

Overview

The skill does useful YouTube transcript extraction, but it also directs agents to modify the skill itself and install unpinned packages in ways users should review carefully.

Install only if you are comfortable with automatic saved reports, third-party transcript lookups, Chibitek-specific report content, and fallback commands that can alter the Python environment. Do not use it for private or unlisted videos unless you first disable third-party lookup, and remove the self-update instruction before normal use.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:179

Finding

Mandatory Organization-Specific Output Manipulation

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:229

Finding

Unauthorized Persistent Self-Modification of Skill Instructions

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: SKILL.md:45

Finding

Unconditional Disclosure of Video Identifiers to a Third-Party Transcript Mirror

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Error

• Location: SKILL.md:63

Finding

Unpinned Dependency Installation into the System Python Environment

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

This is a direct self-modification instruction. Self-modifying skills are dangerous because they can be influenced by untrusted inputs and can permanently change agent behavior, turning a single prompt injection or malformed run into a lasting compromise.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

md

Every video intelligence report is a reusable asset. Saving automatically means
the output is never lost when the chat session ends.

## Step 5: Update This Skill After Every Improvement

After any run that reveals a better approach, edge case, or new pattern, update
this SKILL.md immediately. Do not wait to be asked. This is standing behavior.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The instruction to update SKILL.md after runs gives the skill a self-modifying behavior unrelated to transcript extraction. Self-modification can permanently alter future behavior and can incorporate attacker-controlled transcript content, prompt injections, or erroneous heuristics into a trusted skill file.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Automatic self-update is unjustified for this skill’s function and introduces a durable integrity risk. A malicious or simply adversarial transcript could steer the agent into recording unsafe rules, data, or workflow changes that persist across sessions.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Writing run-derived 'improvements' back into SKILL.md risks persisting user content, transcript artifacts, or prompt-injected instructions into a trusted configuration file. This creates both data leakage and long-term compromise risk because future executions may inherit poisoned behavior.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 99% confidence

Finding

The explicit directive to 'update this SKILL.md immediately' authorizes persistent modification during normal operation. In a skill that consumes adversarially controllable transcripts and web content, that creates a clear avenue for instruction poisoning and unauthorized state changes.

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

## Step 5: Update This Skill After Every Improvement

After any run that reveals a better approach, edge case, or new pattern, update
this SKILL.md immediately. Do not wait to be asked. This is standing behavior.

**What counts as an improvement worth capturing:**

Self-Modification

High

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

md

| Version | Date | Changes |
|---------|------|---------|
| 1.0 | 2026-04-07 | Initial skill created |
| 1.1 | 2026-04-07 | Added Wave Tube as primary fetch method (IP block fix), corrected YouTubeTranscriptApi v1.0+ syntax (.fetch() not .get_transcript()), added auto-save as standing behavior, added skill self-update rule, added changelog |

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill mandates saving every generated report to disk as standing behavior, even though the declared purpose is transcript extraction and analysis. That expands the skill from transient processing into persistent data handling, which can store user-supplied transcripts, URLs, and derived notes without explicit user consent or need.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs automatic file saving without warning the user that transcript-derived content will be persisted. This can surprise users, create privacy issues, and retain copyrighted or sensitive text longer than intended.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

A standing instruction to persist every report can expose user-provided transcript content beyond the active session. In this context, the skill may process pasted transcripts or extracted prompts containing confidential, personal, or copyrighted material, so automatic persistence increases the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The save-to-workspace instructions specify a persistent path and require saving every report, but do not warn about storage or sensitivity of transcript content. Because transcripts may include user-pasted material or proprietary notes, this creates avoidable privacy and data governance risk.

Content

No source excerpt is available for this finding.

Indirect Prompt Extraction

Medium

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains patterns that could indirectly extract system prompts through rephrasing, translation, summarization, or side-channel techniques.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md

**Vague action items**
Bad: `- [ ] Learn more about AI prompting`
Good: `- [ ] Try reverse prompting: ask OpenClaw to extract your goals by asking you questions`

**Paraphrasing prompts instead of reconstructing them**
If a speaker reads a prompt aloud or shows it on screen, write the actual prompt text

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The manifest says not to use the skill when the user only wants a basic summary with no actionable extraction, yet the report template later mandates inclusion of a summary line for every report. While not a full contradiction in behavior, the documentation sends mixed signals about whether summarization is excluded or always part of output.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.