ClawHub
Back to skill

Security audit

YouTube Transcribe

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent YouTube transcription helper; it uses expected local tools and optional Whisper dependencies, with no evidence of hidden persistence, credential access, exfiltration, or destructive behavior.

Install this only if you are comfortable running yt-dlp and optional Whisper packages locally. Use a dedicated virtual environment for the Python backends, prefer pinned package versions where possible, and remember that fallback transcription may download YouTube audio temporarily and use significant compute.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:62
Finding

Unpinned Third-Party Transcription Dependencies

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 62–64
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

text
1. `mlx-whisper` — Apple Silicon native, fastest on Mac (pip install mlx-whisper)
2. `faster-whisper` — CTranslate2 backend, fast on CUDA/CPU (pip install faster-whisper)
3. `openai-whisper` — Original Whisper, universal fallback (pip install openai-whisper)

Technical Analysis

The documentation instructs users to install Python packages without exact version constraints, integrity hashes, or a reviewed lockfile. These commands resolve the latest package versions and their transitive dependencies from the user's configured Python package index at installation time.

Consequently, the effective dependency code can change after the Skill has been audited. If a named package, transitive dependency, maintainer account, or configured package index is compromised, installation or subsequent import of the affected dependency could execute attacker-controlled code. The project does not provide reproducible dependency metadata that would allow users to verify that they are installing the versions reviewed by the Skill author.

The transcription dependencies are legitimate and necessary for the local Whisper fallback, but allowing unrestricted versions exceeds the minimum supply-chain trust required to provide that functionality.

Attack Path

  1. An attacker compromises a listed package, one of its transitive dependencies, or a package-index source configured on the target system.
  2. The attacker publishes a malicious release that remains compatible with the unpinned package name.
  3. A user follows one of the documented pip install instructions.
  4. The package manager resolves the malicious release because no exact version or integrity hash is required.
  5. Attacker-controlled code executes during package installation or when `scripts/transcri ...[truncated 984 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin each supported backend to an exact, reviewed version instead of installing an unrestricted latest release.
  2. Provide a version-controlled requirements file or lockfile that also constrains transitive dependencies.
  3. Record cryptographic hashes for all distributions and require verification with a command such as pip install --require-hashes -r requirements.txt.
  4. Prefer a trusted package index explicitly documented by the project, and warn users against untrusted mirrors or extra indexes.
  5. Review package provenance, release signatures where available, maintainer history, and dependency changes before updating pinned versions.
  6. Test dependency updates in an isolated environment before publishing a new lockfile.
  7. Recommend installation in a dedicated virtual environment with only the filesystem and network access required for transcription.
  8. Keep the three Whisper backends optional so users install only the backend needed for their hardware, reducing dependency and attack surface.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill advertises and instructs use of shell execution, environment access, and file read/write behavior, but it does not declare any explicit tool scope or permissions boundary. That creates an authorization ambiguity where a host agent may grant broader capabilities than users expect, increasing the risk of unintended command execution, local file access, or writes during transcription workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill does not clearly warn users that fallback transcription downloads YouTube audio locally and that transcripts may be saved to disk. This can expose sensitive viewing activity, consume storage/bandwidth, and leave residual media or transcript artifacts on the system without informed user consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The documented behavior states that when no language is specified, the skill searches the video's original language, then Chinese variants, then English, then any language. This creates a locale preference policy in natural language without user choice or justification, which can conflict with language/locale neutrality expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The positive trigger set is hard-coded to English and Traditional Chinese examples only, which can encode a language/locale constraint in the skill's natural-language behavior without documenting user choice. There is no surrounding text indicating that users may interact in other languages or that these languages are merely illustrative examples.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The positive trigger examples include broad phrases like 'summarize this YouTube video for me', 'convert this video to text', and 'can you get the captions from this YouTube video?' without consistently requiring a YouTube URL or other clear scope constraint. This can cause the skill to trigger on ambiguous requests that may refer to non-YouTube or unsupported inputs, leading to overbroad activation and unintended handling of user requests.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 57)May include surrounding context.

python
url,
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            data = json.loads(result.stdout)
            return {

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 120)May include surrounding context.

python
url,
            ]
            try:
                subprocess.run(cmd, capture_output=True, text=True, timeout=30)
            except subprocess.TimeoutExpired:
                continue

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 217)May include surrounding context.

python
try:
        if platform.system() == "Darwin":
            # macOS: use sysctl
            result = subprocess.run(
                ["sysctl", "-n", "hw.memsize"],
                capture_output=True, text=True, timeout=5,
            )

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
78% confidence
Finding

This dynamic import is additionally influenced by environment-controlled backend selection, so an attacker who can affect the runtime environment and import path may steer execution toward a malicious module name from the allowed set if import resolution is hijacked. While the names are constrained, Python import shadowing still makes this a realistic code-execution hardening issue in shared or untrusted execution contexts.

Content

Scanner excerpt · scripts/transcribe.py (reported line 254)May include surrounding context.

python
for name, module_name in backends:
            if name == env_backend or module_name == env_backend:
                try:
                    mod = __import__(module_name)
                    return name, mod
                except ImportError:
                    print(f"⚠️  Requested backend '{env_backend}' not installed, trying others...",

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic imports are performed by module name and rely on Python's import resolution, which can load a malicious local module if the execution environment or PYTHONPATH is attacker-controlled. In an agent/skill context that may run in varied workspaces, this creates a module-hijacking risk that could lead to arbitrary code execution when backend autodetection runs.

Content

Scanner excerpt · scripts/transcribe.py (reported line 264)May include surrounding context.

python
# Auto-detect
    for name, module_name in backends:
        try:
            mod = __import__(module_name)
            return name, mod
        except ImportError:
            continue

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 308)May include surrounding context.

python
url,
    ]
    print("📥 Downloading audio...", file=sys.stderr)
    result = subprocess.run(cmd, capture_output=True, text=True, timeout=300)
    if result.returncode != 0:
        print(f"❌ Audio download failed: {result.stderr}", file=sys.stderr)
        sys.exit(1)

Static analysis

No suspicious patterns detected.