ClawHub
Back to skill

Security audit

Youtube Transcribe Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent YouTube transcript extractor, but it defaults to reading the user's browser cookies without clear user consent or narrow scoping.

Review before installing. Use this skill only if you are comfortable with `yt-dlp` or browser automation accessing your YouTube/browser session. Prefer running transcript extraction without `--cookies-from-browser` first, and only allow cookie access for restricted videos after explicit confirmation, ideally from a dedicated browser profile. Expect it to create a local transcript file in the current working directory.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:30
Finding

Unnecessary Default Access to Browser Authentication Cookies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 30-42
Vulnerability Type: Least-privilege violation through unnecessary access to sensitive browser session data
Risk Level: Medium

Vulnerable Code

markdown
2. **Execute Subtitle Download** (Only if `yt-dlp` is found):

   - **Tip**: Always add `--cookies-from-browser` to avoid sign-in restrictions. Default to `chrome`.
   - **Retry Logic**: If `yt-dlp` fails with a browser error (e.g., "Could not open Chrome"), ask the user to specify their available browser (e.g., `firefox`, `safari`, `edge`) and retry.

   ```bash
   # Get the title first (try chrome first)
   yt-dlp --cookies-from-browser=chrome --get-title "[VIDEO_URL]"

   # Download subtitles
   yt-dlp --cookies-from-browser=chrome --write-auto-sub --write-sub --sub-lang zh-Hans,zh-Hant,en --skip-download --output "<Video Title>.%(ext)s" "[VIDEO_URL]"
   ```

Technical Analysis

The Skill instructs the agent to include --cookies-from-browser=chrome in every yt-dlp invocation. This option causes yt-dlp to locate, decrypt, and load cookies from the user's Chrome profile, potentially including authenticated Google and YouTube session cookies.

Public video metadata and captions ordinarily do not require authentication. Consequently, accessing browser cookies before an authentication-specific failure exceeds the minimum privileges needed for the declared transcript-extraction functionality. The fallback advice may extend the same access to Firefox, Safari, or Edge profiles.

The cookies are used by yt-dlp in requests to YouTube. The reviewed Skill does not instruct the agent to transmit them to an unrelated third-party endpoint, so deliberate credential exfiltration is not established. Nevertheless, exposing authenticated browser state to a local executable increases the consequences of a compromised, outdated, replaced, or unexpectedly configured yt-dlp installation.

...[truncated 1255 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove --cookies-from-browser from the default commands and attempt public metadata and subtitle extraction anonymously first.
  2. Enable browser-cookie access only after an error clearly indicates that authentication is required, rather than after an unrelated download failure.
  3. Obtain explicit, informed user consent before reading a browser profile. Explain that the operation exposes authenticated browser state to yt-dlp.
  4. Ask the user to confirm that they are authorized to access the restricted content.
  5. Prefer a dedicated browser profile containing only the minimum cookies required for YouTube instead of the user's primary profile.
  6. Avoid printing, persisting, or including cookie values in diagnostic output.
  7. Verify that yt-dlp is obtained from a trusted source and kept updated before granting it access to authenticated browser data.
  8. Narrow the front-matter tool allowlist by replacing wildcard Chrome MCP access with only the page, snapshot, click, script-evaluation, and close operations required by the documented workflow.

SkillSpector

Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
97% confidence
Finding

The skill explicitly instructs use of yt-dlp --cookies-from-browser=chrome, which accesses authenticated browser cookies from the local browser profile. Even if intended to bypass age/sign-in restrictions for transcript extraction, this creates unnecessary exposure of sensitive session material and normalizes browser-cookie access in an automation skill, increasing the risk of credential/session theft or misuse.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

file naming.

Step 2: CLI Quick Extraction (Priority Attempt)

Use command-line tools to quickly extract subtitles.

  1. Check Tool Availability: Execute which yt-dlp.

    • If yt-dlp is found, proceed to subtitle download.
    • If yt-dlp is NOT found, skip immediately to Step 3.

  2. Execute Subtitle Download (Only if yt-dlp is found):

    • Tip: Always add --cookies-from-browser to avoid sign-in restrictions. Default to chrome.
    • Retry Logic: If yt-dlp fails with a browser error (e.g., "Could not open Chrome"), ask the user to specify their available browser (e.g., firefox, safari, edge) and retry.
    bash
    # Get the title first (try chrome first)
yt-dlp --cookies-from-browser=chrome --get-title "[VIDEO_URL]"

# Download subtitles
yt-dlp --cookies-from-browser=chrome --write-auto-sub --write-sub --sub-lang zh-Hans,zh-Hant,en --skip-download --output "<Video Title>.%(ext)s" "[VIDEO_URL]"

  3. *Verify Results

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file directs the agent to write subtitle text to the current working directory, but it does not warn the user that running the skill will create a local file. For markdown skills, SQP-2 applies when the description omits warnings about behaviors that can affect user data or system state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.