Content Creator Skill

• Outcome: Review
• Latest audit: Sep 14, 2026 · 9:38 PM UTC
• Version: 0.2.0

Overview

The skill mostly matches its YouTube tracking purpose, but its transcript fetcher can be steered to request arbitrary caption URLs from the user's environment.

Install only if you are comfortable with a YouTube skill that stores followed creators locally and may send upload metadata through your configured notification adapter. Review or patch the transcript fetcher to restrict caption URLs to legitimate YouTube/Google caption hosts before using it in an environment with access to internal services or private networks.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: src/transcript.js:99

Finding

Unrestricted Caption URL Fetch Enables Server-Side Request Forgery

Content

View full analysis

Vulnerability Details

File Location: src/transcript.js:99-111
Vulnerability Type: Server-Side Request Forgery (SSRF)
Risk Level: Medium

Vulnerable Code

js

const track = pickBestTrack(tracks);
if (!track || !track.baseUrl) {
  return { ok: false, reason: "no_suitable_caption_track" };
}

let xml;
try {
  const response = await fetchImpl(track.baseUrl, {
    headers: { accept: "application/xml, text/xml" },
  });
  xml = await response.text();
} catch {
  return { ok: false, reason: "fetch_captions_failed" };
}

Technical Analysis

The Skill extracts captionTracks from remotely retrieved YouTube watch-page HTML. It then passes the selected track's baseUrl directly to the runtime fetch implementation without validating:

• The URL scheme
• The destination hostname
• The destination port
• The resolved IP address
• Redirect destinations

Consequently, remotely supplied page content controls the destination of a server-side HTTP request. Tests at test/index.test.js:1043-1057 also demonstrate that caption URLs on an arbitrary non-YouTube hostname are accepted.

The expected functionality only requires access to legitimate YouTube caption services. Permitting requests to arbitrary destinations therefore exceeds the minimum network privileges necessary for transcript retrieval.

No credentials or API keys are explicitly attached to the caption request, so the confirmed risk is internal network reachability rather than direct credential disclosure.

Attack Path

1. A user or automated workflow invokes the analyze_video action for a supported YouTube video.
2. The Skill requests the corresponding YouTube watch page.
3. A malicious, compromised, intercepted, or custom fetch response supplies a captionTracks entry whose baseUrl points to an attacker-selected destination.
4. The Skill selects that caption track and calls fetchImpl(track.baseUrl) without destination validation.
5. The host runtime sends a request to the s ...[truncated 994 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse track.baseUrl with new URL() and reject malformed URLs.
2. Require HTTPS and reject embedded usernames or passwords, fragments, and nonstandard ports.
3. Enforce an explicit allowlist of legitimate YouTube caption-service hostnames rather than accepting arbitrary hosts.
4. Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and unspecified IPv4 and IPv6 ranges.
5. Disable automatic redirects or validate the destination again after every redirect.
6. Apply DNS-rebinding protections by ensuring the validated address is the address used for the connection.
7. Set strict connection, response, and total-operation timeouts.
8. Limit response size before reading the complete body into memory.
9. Add negative tests covering:
   • localhost and loopback addresses
   • RFC 1918 private addresses
   • IPv6 loopback and private ranges
   • Cloud metadata addresses
   • Non-HTTPS schemes
   • Redirects from an allowed host to a prohibited destination
   • Arbitrary external domains
10. Retain the fixed YouTube Data API destination used by src/youtube-api.js; the optional API key transmission to that fixed Google endpoint is necessary for the declared enhanced mode and was not identified as unauthorized disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description promises end-user functionality around YouTube creator tracking and AI-powered video breakdowns. The supplied code does none of that. It is a build/release utility script operating on local project files such as SKILL.md, manifest.yaml, README.md, config.example.yaml, package.json, src/index.js, and tests. Its primary purpose is ensuring release/package consistency and required documentation content before publishing. This is a materially different purpose from the declared skill behavior, so the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broader YouTube analysis and creator-following skill. The supplied code chunk performs only lightweight text processing on already-provided metadata fields such as channel name, title, description, URL, and publish date. It extracts description lines as bullets and assembles markdown. This is materially narrower than the declared purpose, because the core advertised capabilities—link-based processing, creator tracking, notifications, and meaningful AI analysis of video content—are absent from the code shown.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code is focused on YouTube channel and upload tracking infrastructure: it normalizes YouTube inputs, resolves channels from channel URLs/handles/usernames/video IDs, fetches channel metadata, and retrieves latest uploads either through the YouTube API or public RSS/feed parsing. This aligns with the 'follow creator for new upload notifications' portion of the description. However, the prominently declared capability of analyzing video content and returning an AI-powered breakdown is not represented anywhere in this code chunk. There is no transcript retrieval, no LLM invocation, no summary generation, and no extraction of key points or significance. Therefore the description materially overstates what this code actually does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The 'When to Use' section includes broad conditions such as wanting to 'understand the content quickly' or 'analyze a video' without clearly constraining how explicitly the user must invoke this skill. This can cause unintended activation for ordinary YouTube-related conversation, especially because no exclusion conditions or negative examples are provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill persists a local watchlist and may send runtime notifications, but that data-retention and outbound-notification behavior is only disclosed in the limitations section rather than prominently in the main description or consent flow. Users may unknowingly cause storage of creator-follow preferences or background notifications, which creates privacy and consent risks, especially in shared or multi-user environments.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The request hard-codes an Accept-Language preference of zh-CN/zh ahead of English, which imposes a locale preference without any user opt-in. This matches the policy category for language or locale constraints because the file does not offer a choice or document a region-specific reason for forcing that preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Because SQP-3 applies to natural-language policy expressed in code as well as documentation, the test names and assertions here explicitly enforce a locale preference: "prefers Chinese over English" and fallback to English otherwise. This bakes a language-selection policy into expected behavior without offering user choice or documenting a justified regional constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The markdown explains that notify_watchlist_updates will deliver notification payloads through runtime interfaces such as context.deliver, context.notify, and channel send methods. While the behavior is documented, it does not explicitly warn users that video metadata and update content may be sent to external delivery targets like Telegram or connected channels, which is relevant to privacy and system-integrity expectations.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This manifest is in scope for vague-trigger review, and the top-level description only states what the skill does without clarifying when it should or should not be invoked. There are no explicit trigger phrases, context limits, or exclusion examples to prevent broad matching against general requests about YouTube creators or updates.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This code makes external data-fetching calls to resolve YouTube targets, retrieve uploads, and fetch transcripts, which are network operations involving user-supplied input. In this file there is no confirmation prompt, logging, comment, or docstring disclosing that external requests will be made.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

This code dispatches notification content and metadata through runtime delivery adapters, which may transmit user or system data to external channels. The file contains no confirmation prompt and no inline comment or docstring warning that notification text, markdown, or metadata will be sent out.

Content

No source excerpt is available for this finding.