边看边记-视频要点自动归纳

• Outcome: Review
• Latest audit: Jul 23, 2026 · 2:09 AM UTC
• Version: 1.3.0

Overview

This skill has a legitimate subtitle-summary purpose, but it asks the agent to inspect login tokens and save broad authenticated page/API data beyond a simple transcript workflow.

Install only if you are comfortable with the agent using a logged-in browser session for course pages and saving extracted course/page data locally. Treat the generated JSON files as potentially private, review them before sharing, and avoid using this skill on accounts or courses where token inspection or broad page/API capture is not acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill declares no permissions while instructing use of network access, Playwright automation, and file output. This creates a transparency and policy-enforcement gap: reviewers and runtime controls may underestimate what the skill can do, allowing data collection and persistence beyond what users or operators expect.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The skill claims it only extracts exposed subtitles/transcripts, but the described behavior includes intercepting multiple backend API responses, saving full page body text, and collecting video element metadata. In a logged-in learning-platform context, this can over-collect sensitive course content, account-scoped data, or proprietary material well beyond the user's expected transcript-only processing boundary.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The guide goes beyond visible transcript extraction by explicitly retrieving authentication tokens from localStorage and describing how to use them for authenticated API calls. This expands the skill from user-visible automation into session/credential handling, increasing the risk of unauthorized access, over-collection, and leakage of sensitive account-scoped data.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The document recommends intercepting authenticated API responses during page load to obtain course metadata and AI-generated study summaries, which exceeds the stated scope of extracting exposed subtitles/transcripts. Even if the browser session is user-authenticated, collecting backend API data broadens access to non-visible, potentially sensitive information and creates a pathway for misuse.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The extractor collects and stores far more than subtitle/transcript data: full page body text, video metadata, course metadata, guide records, and multiple authenticated API responses. In a logged-in learning platform context, this broad capture can expose private course content or user-associated data unrelated to the stated purpose, violating data minimization and increasing the blast radius if the output files are accessed or reused.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code reads `localStorage` token data during an authenticated browser session even though token access is not necessary for subtitle extraction. Even though it only persists derived token metadata, touching authentication material creates unnecessary exposure and normalizes access to credentials; future modifications, logs, exceptions, or debugging could accidentally leak the raw token and compromise the user's account.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly instructs extracting a bearer access token from localStorage and using it for Authorization, which means the automation is handling reusable user credentials rather than only reading already-visible page content. In this context, that expands the skill from passive subtitle extraction into credential use against authenticated APIs, increasing the risk of session misuse, overcollection, and exfiltration if the workflow or downstream prompts are abused.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide instructs reading authentication material from localStorage and constructing Bearer-token API requests without any credential-handling safeguards. Session tokens are highly sensitive secrets; exposing, logging, or reusing them can enable account access, data extraction, and session hijacking if mishandled.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The workflow saves full page text, video metadata, and API-derived course/study data to output.json without warning that these artifacts may contain personal, proprietary, or account-scoped information. Persisting such data to disk increases the chance of accidental retention, local disclosure, and secondary misuse beyond the user's immediate task.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script writes authenticated extraction results to local JSON files without warning the user that the data may include private course content and other page-derived information. In this skill's context, the browser is manually logged into a protected learning platform, so the saved files may contain sensitive educational content or account-scoped data that persists beyond the session and can be unintentionally shared.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.