Youtube Content

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:11 AM UTC
• Version: 2.0.1

Overview

The bundled YouTube tool looks purpose-aligned, but its install instructions tell users to download and run mutable remote Python code instead of the reviewed bundled file.

Review before installing. Prefer running the bundled artifact/SKILL.md package copy of youtube_content.py rather than downloading from a mutable main-branch URL, and only run the CI verifier on repositories you trust or inside an isolated environment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:34

Finding

Mutable Remote Python Payload Download and Execution

Content

View full analysis

Vulnerability Details

File Location: README.md:34-43; SKILL.md:32-41
Vulnerability Type: Remote payload retrieval and execution through an unpinned source
Risk Level: High

The installation documentation instructs users to download a Python executable from the mutable main branch of a repository controlled by an individual account:

README.md:34-43

bash

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/youtube-content/main/youtube_content.py
# Or copy the file anywhere — it's self-contained.

bash

python youtube_content.py --help        # list options

SKILL.md:32-41

bash

# Requires Python 3.8+. No pip install needed.
curl -O https://raw.githubusercontent.com/itsPremkumar/youtube-content/main/youtube_content.py
# Or copy the file anywhere — it's self-contained.

bash

python youtube_content.py --help        # list options

Technical Analysis

The URL references the mutable main branch rather than an immutable commit or cryptographically verified release. Consequently, the downloaded program is not guaranteed to be the same youtube_content.py that was included in and reviewed as part of this Skill package.

The instructions do not provide a checksum, digital signature, pinned commit identifier, or other integrity control. Although curl does not execute the response immediately, the documented quick-start command subsequently runs the downloaded file with Python. Any Python statements at module scope or in the entry point would execute with the permissions of the invoking user.

This remote download is unnecessary for the declared functionality because a self-contained copy of youtube_content.py is already included in the project. The audited bundled implementation did not contain credential theft, persistence, privilege escalation, hidden command execution, or other malicious behavior; the ...[truncated 1594 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the remote download instruction and direct users to execute the reviewed youtube_content.py already included in the Skill package.
2. If remote distribution is required, pin the URL to an immutable, reviewed commit instead of main, for example:

   bash

   curl -fL -o youtube_content.py \
     https://raw.githubusercontent.com/itsPremkumar/youtube-content/IMMUTABLE_COMMIT_SHA/youtube_content.py
   

3. Publish the expected SHA-256 digest through a separately protected release channel and require verification before execution:

   bash

   echo "EXPECTED_SHA256  youtube_content.py" | sha256sum --check -
   

4. Prefer signed release artifacts or signed Git tags, and document signature verification.
5. Make curl fail on HTTP errors by using -fL, write to an explicit filename, and avoid silently retaining an unexpected server response.
6. Ensure CI compares the distributed artifact against the reviewed repository copy and fails if they differ.
7. Apply the same remediation consistently to both README.md and SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a YouTube content tool, yet the detected behavior includes local folder inspection, Python compilation checks, subprocess execution, secret scanning, and project-structure validation. In agent contexts, this broader hidden behavior materially increases risk because a user invoking transcript extraction may unintentionally grant the skill access to local code, files, and command execution pathways.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is presented as a YouTube content tool, yet the detected behavior includes local folder inspection, Python compilation checks, subprocess execution, secret scanning, and project-structure validation. In agent contexts, this broader hidden behavior materially increases risk because a user invoking transcript extraction may unintentionally grant the skill access to local code, files, and command execution pathways.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares no explicit tool scope or permissions while the associated capability set includes file read, network, and shell access. In an agent environment, missing scope boundaries can let a seemingly simple YouTube-processing skill invoke broader local or remote actions than users expect, increasing the risk of overprivileged execution.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script executes an arbitrary Python file from the target folder with self-test if present. Because the file path is discovered from untrusted repository contents, this turns verification into code execution of attacker-controlled code, which can run during CI or on a maintainer workstation.

Content

Scanner excerpt · ci/verify_product.py (reported line 37)May include surrounding context.

python

def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Beyond the code-execution risk itself, the tool gives no explicit warning that verification may run arbitrary code from the target folder. Users may reasonably expect a verifier to be read-only, so the lack of notice increases the chance that maintainers execute malicious skill code on sensitive systems.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 67)May include surrounding context.

python

all_ok &= axis(False, "frontmatter (no SKILL.md)")
        all_ok &= axis(False, "docs (no SKILL.md)")
    # 3 compiles
    comp_ok = all(subprocess.run([sys.executable, "-m", "py_compile", fp],
                                capture_output=True).returncode == 0 for fp in files)
    all_ok &= axis(comp_ok, "compiles (py_compile all .py)")
    # 4 self-test (any of 3 valid forms)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script silently runs test files discovered by filename pattern from the target folder. That behavior can surprise users and leads to unsafe trust of repository contents, especially in CI workflows where unreviewed pull-request code may be analyzed automatically.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 98% confidence

Finding

The verifier automatically discovers test_*.py or *_test.py files and executes them. In an untrusted skill or pull request, an attacker can place malicious code in a test file, causing arbitrary code execution during CI or local verification.

Content

Scanner excerpt · ci/verify_product.py (reported line 79)May include surrounding context.

python

tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · ci/verify_product.py (reported line 92)May include surrounding context.

python

# 7 deploy-ready
    ci = os.path.join(os.path.dirname(os.path.abspath(__file__)), "ci_check.py")
    if os.path.isfile(ci) and os.path.isfile(skill):
        r = subprocess.run([sys.executable, ci], cwd=folder, capture_output=True, text=True)
        all_ok &= axis(r.returncode == 0, "deploy-ready (ci/ci_check.py PASS)")
    else:
        all_ok &= axis(True, "deploy-ready (skipped)")

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This markdown file states that the tool extracts transcripts, summaries, and metadata from YouTube, which necessarily involves outbound network access to a third-party service. The description does not include any warning about contacting YouTube or transmitting requested video identifiers/query data, so the behavior is not explicitly disclosed from a privacy/network perspective.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

Launching another Python script is a subprocess execution path that may affect user expectations, especially when the tool is run locally. While the harness explains it checks 'deploy-ready', it does not explicitly disclose that this means executing ci/ci_check.py.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description scopes the skill to processing a specified YouTube video's transcript, summary, and metadata. The cmd_search function adds a distinct discovery capability that searches YouTube by arbitrary topic, which is not implied by extracting content from a provided video.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.