Security audit
extract-youtube-transcript
Security checks for vulnerabilities and agentic risk
Overview
The code and docs match the stated purpose (extracting YouTube transcripts) but the skill bundles an embedded Netscape-format YouTube cookies file containing authentication tokens — an unnecessary and disproportionate sensitive artifact that raises risk.
This skill's code correctly implements transcript extraction, but it includes a Netscape-format cookies file containing many authentication/session tokens. Treat that file as sensitive: do not use the included cookies file or share it. Before installing or running the skill, either remove scripts/youtube_cookies.txt or replace it with a cookies file you explicitly provide and trust. Inspect SKILL.md and the Python file for any hidden or encoded content (scanner flagged a base64-block). If you must use cookies to access private/age-restricted videos, generate and supply your own cookies securely and run the script in an isolated environment. If you cannot verify the origin of the cookie values, avoid running the packaged cookies and consider obtaining the script from a trusted source or rewriting the minimal functionality yourself.
SkillSpector findings are pending for this release.