T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/youtube_transcript_fetcher.py:26- Finding
Unrestricted Channel URL Enables Server-Side Requests to Arbitrary Network Destinations
- Content
View full analysis
- Remediation
View remediation
Security audit
YouTube Transcript Fetcher
Security checks for vulnerabilities and agentic risk
Overview
This is mostly a coherent YouTube transcript tool, but its channel input can be used to send network requests to non-YouTube destinations, so it should be reviewed before installation.
Install only if you are comfortable running yt-dlp and Python dependencies with network access. Prefer using explicit YouTube video IDs, YouTube URLs, or trusted channel handles, and avoid untrusted batch config files until the channel URL handling is restricted to YouTube domains and dependencies are pinned.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Note
- Location
requirements.txt:1- Finding
Third-Party Python Dependencies Are Not Reproducibly Pinned
- Content
View full analysis
=2.31.0 youtube-transcript-api>=0.6.2 ``` ### Technical Analysis The dependency declarations specify only minimum versions. Consequently, `pip install -r requirements.txt` may install any later release accepted by the resolver. The project does not provide a lock file or cryptographic hashes to identify the exact reviewed artifacts. This makes installation and execution non-reproducible. Future releases may introduce incompatible behavior or security defects. If a package publisher account or package index is compromised, a malicious newer release could also be selected automatically. This finding does not establish that the currently named packages or versions are malicious. It is a supply-chain hardening weakness that permits unreviewed dependency code to enter the Skill environment. ### Attack Path 1. A user follows the documented instruction to run `pip install -r requirements.txt`. 2. The package resolver queries the configured Python package index. 3. It selects dependency releases newer than the minimum versions listed in the file. 4. A compromised, malicious, or otherwise unsafe release is downloaded and installed. 5. The dependency's code executes when imported or used by the transcript fetcher. Installation-time execution may also be possible depending on the selected distribution format and build process. This path requires an unsafe future release, compromise of the package distribution channel, or manipulation of the package index used by the environment. ### Impact Assessment Third-party dependency code runs with the same operating-system permissions as the Skill process. A malicious dependency could therefore access files readable by that account, inspect environment variables, make network requests, alter generated ...[truncated 225 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
Findings (9)
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
or:
bash sudo apt install yt-dlpAdd it to OpenClaw
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 95% confidence
- Finding
The skill requests or implies broad capabilities (file read/write, network, shell) but does not declare an explicit tool scope such as permissions or allowed-tools. This creates an authorization gap where an agent may invoke the skill without clear sandbox expectations, increasing the chance of unintended command execution, network access, or filesystem modification beyond what a transcript-fetching task should require.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python url = f"https://www.youtube.com/@{channel_id}/videos" try: result = subprocess.run( [ "yt-dlp", "--flat-playlist",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def get_video_details(video_id: str) -> Optional[Dict]: """Get detailed video metadata using yt-dlp""" try: result = subprocess.run( [ "yt-dlp", "--no-warnings",
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This skill explicitly sets locale fields such as hl="en" and gl="US" for multiple client profiles, and later prioritizes specific languages for transcript retrieval. Because the file provides no user opt-in or configurable locale selection, it imposes a language/locale policy in a way that may violate organizational requirements for user choice.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python for attempt in client_attempts: try: response = requests.post( url, headers={ "User-Agent": attempt["user_agent"],
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The dependency is specified with a lower bound only, so builds may resolve to different versions over time. This weakens supply-chain reproducibility and can allow unintentionally pulling a newly introduced vulnerable or breaking release.
- Content
text requests>=2.31.0 youtube-transcript-api>=0.6.2
Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected
Low
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
The manifest references requests without pinning an exact version, and requests has multiple historical advisories. Because the resolved version is unconstrained above the minimum, it is not possible to verify from this file alone whether deployment will avoid affected versions, creating avoidable supply-chain uncertainty.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 95% confidence
- Finding
The package is not pinned to an exact version, which makes installations non-reproducible and increases supply-chain risk. A future dependency resolution could select a compromised or vulnerable release without any change to this repository.
- Content
text requests>=2.31.0 youtube-transcript-api>=0.6.2
Static analysis
No suspicious patterns detected.