Index Youtube

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:22 PM UTC
• Version: 2.0.0

Overview

The skill has a coherent YouTube transcript indexing purpose, but it casually recommends using Chrome browser cookies and unpinned package execution without enough warning or scoping.

Install only if you are comfortable with local command execution and third-party Python packages. Avoid using --cookies-from-browser chrome unless you intentionally want yt-dlp to access your Chrome session cookies, and prefer pinned package versions or an isolated environment before running the setup commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:42
• Finding: Unpinned Third-Party Packages May Execute Untrusted Supply-Chain Code<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 42-47 and 64-67 **Vulnerability Type**: Unpinned dependency installation and immediate execution **Risk Level**: Medium ### Vulnerable Code ```bash # Install solograph pip install solograph # or uvx solograph ``` The Skill also recommends immediate package retrieval and execution: ```bash uvx solograph-cli index-youtube -c <handle> -n 10 ``` Additional unpinned installation guidance appears at lines 151-155: ```bash pip install solograph ``` ### Technical Analysis The Skill installs or executes third-party Python packages without specifying reviewed versions, cryptographic hashes, or a verified package source. In particular, `uvx` can retrieve and immediately execute the currently published package from a package registry. The documentation alternates between the package or command names `solograph` and `solograph-cli`. Without explicit clarification of the canonical distribution name and publisher, this inconsistency increases the risk of package substitution, typosquatting, or dependency confusion. The effective code executed by these commands can change after the Skill has been audited because the package registry determines which current release is downloaded. Therefore, reviewing `SKILL.md` alone cannot establish the safety of the code ultimately executed. ### Attack Path 1. An attacker publishes a package under a confusingly similar or incorrectly referenced name, compromises the legitimate package, or compromises a future package release. 2. A user or agent follows the Skill's installation guidance or invokes the documented `uvx` command. 3. The package manager retrieves the current unpinned package from the configured registry. 4. Package installation hooks, imported modules, or the package entry point execute attacker-controlled code. 5. The malicious code runs with the permissions and environment available to the user or agent executing the Skill. ### Impact Assessment ...[truncated 650 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every dependency to a reviewed, exact version rather than installing the latest available release. 2. Use hash-verified installation, such as a locked requirements file containing `--hash` entries. 3. Document the canonical package name, publisher, official repository, and expected command name. 4. Resolve the inconsistency between `solograph` and `solograph-cli` before recommending either package. 5. Avoid retrieving and immediately executing packages through `uvx`; separate package acquisition, verification, and execution. 6. Install dependencies in an isolated virtual environment or sandbox with minimal filesystem and network permissions. 7. Review package updates before changing the pinned version. 8. Prefer a trusted internal package mirror or an allowlisted registry when the Skill is deployed in a sensitive environment. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:28
• Finding: User-Controlled Arguments Lack Explicit Validation Before Shell Command Construction<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 28-31, with shell command sinks at lines 50-67 and 79-93 **Vulnerability Type**: Potential shell command injection through unsafe argument interpolation **Risk Level**: Medium ### Vulnerable Code The Skill instructs the agent to parse user-controlled arguments but does not define validation or escaping requirements: ```markdown Parse `$ARGUMENTS` for channel handles or "all": - If empty or "all": index all channels (from config or ask user) - If one or more handles: index only those channels (e.g., `GregIsenberg ycombinator`) - Optional flags: `-n <limit>` (max videos per channel, default 10), `--dry-run` (parse only) ``` The values are subsequently represented as shell-command arguments: ```bash # Single channel solograph-cli index-youtube -c GregIsenberg -n 10 # Multiple channels solograph-cli index-youtube -c GregIsenberg -c ycombinator -n 10 ``` The fallback command uses another externally derived value: ```bash # Download auto-generated subtitles (no video download) yt-dlp --write-auto-sub --sub-lang en --skip-download --sub-format vtt \ -o "docs/youtube/%(channel)s/%(title)s.%(ext)s" \ "<video-url>" ``` ### Technical Analysis The Skill accepts channel handles, limits, flags, and video URLs derived from user input or external command output. It does not require strict allowlist validation, numeric range checking, URL-origin validation, termination of command options, or safe argument-array construction. If an implementation or agent substitutes a malicious value directly into a Bash command string, shell metacharacters such as semicolons, command substitutions, pipes, redirections, or newlines may be interpreted by the shell. Values beginning with a hyphen may also be treated as unintended command-line options. Quoting the documented `<video-url>` placeholder reduces ordinary word splitting when correctly preserved, but it is not a complete input-validation policy. The c ...[truncated 1390 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Validate channel handles using a strict allowlist, such as `^[A-Za-z0-9._-]+$`, and reject all nonmatching input. 2. Parse the video limit as an integer and enforce a reasonable range, such as 1 through 100. 3. Accept only explicitly supported flags; reject unknown options and values beginning with `-` where a handle is expected. 4. Validate video URLs with a URL parser and restrict them to HTTPS URLs on approved YouTube hosts, such as `youtube.com`, `www.youtube.com`, or `youtu.be`. 5. Pass user-controlled values as separate process arguments instead of assembling a shell command string. 6. If Bash is unavoidable, use positional parameters or properly quoted arrays and never use `eval`. 7. Use `--` to terminate command options where the invoked utility supports it. 8. Document that shell metacharacters, control characters, and newlines must be rejected. 9. Require user confirmation before executing commands derived from unusual or externally supplied identifiers. ]]>

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match

Content

dlp`, or `pipx install yt-dlp`.

### Videos skipped (no transcript)
**Cause:** Video has no auto-generated or manual subtitles.
**Fix:** This is expected — some videos lack transcripts. Only videos with available subtitles can be indexed.

### Rate limiting from YouTube
**Cause:** Too many requests in short time.
**Fix:** Reduce `-n` limit, add `--sleep-interval 2` to yt-dlp commands, or use `--cookies-from-browser chrome` for authenticated access.

### solograph-cli not found
**Cause:** solograph not installed or not on PATH.
**Fix:** Install with `pip install solograph` or `uvx solograph`. Check `which solograph-cli`.

• Confidence: 87% confidence
• Finding: Recommending `--cookies-from-browser chrome` instructs the tool to access browser-stored authentication cookies, which are sensitive credentials. Even though the stated purpose is bypassing rate limits or authenticated access, normalizing cookie extraction in a skill increases the chance of credential exposure, misuse of a privileged browser profile, or accidental handling of secrets by downstream tooling.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The skill instructs users to run `uvx solograph` without pinning a specific version. That can cause execution of whatever package version is current at install/run time, creating a supply-chain risk if a malicious or compromised release is published. In a skill that encourages direct command execution, this risk is materially real even if the author likely intended convenience.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The command `uvx solograph-cli` is also unpinned, so it may fetch and execute an unexpected future package version. This exposes users to avoidable remote package execution and supply-chain compromise risk, especially because the skill presents it as a fallback command to run directly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The later install guidance again recommends `uvx solograph` without version pinning, repeating the same package-supply-chain exposure. Repetition in troubleshooting text increases the chance a user will execute the unsafe form verbatim.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill directs downloading transcripts and writing summaries into local `docs/youtube/...` paths but does not clearly warn the user that this creates persistent local copies of third-party content. This is primarily a privacy/data-governance issue rather than code execution, but users may unknowingly store sensitive or copyrighted transcript data on disk.

Static analysis

No suspicious patterns detected.