Security audit
Security checks for vulnerabilities and agentic risk
The skill retrieves YouTube captions through a disclosed paid service and offers clearly optional scheduled delivery to your chosen apps.
An Apify account is required, and requested runs below about $1 may proceed without another confirmation. Before enabling optional delivery, choose the destination and recurring budget carefully; disable the schedule when finished. Inputs and results are processed through Apify.
L149 instructs the agent to create a saved Apify task, add a daily schedule, and configure delivery to Slack, Notion, or Google Sheets. These persistent automation and external-write operations go beyond the manifest's stated transcript and metadata retrieval purpose and are not necessary to fetch captions.
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
## Row size
`both` keeps the segments and the full text, so a one-hour video gives a large row. Use `text` when the agent only reads the words. Large results can fill the context window; save them to a file and read parts.
## MCP connector delivery
The MCP delivery options describe sending transcript results to Slack, Notion pages or databases, and Google Sheets. This introduces writes to external destinations beyond the manifest's stated transcript and metadata retrieval purpose, although delivery requires a user-created connector.
No suspicious patterns detected.