YouTube Video Transcript

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:23 AM UTC
• Version: 1.0.0

Overview

This skill coherently extracts and optionally saves YouTube transcripts using yt-dlp, with local caching and preference storage disclosed as consent-based.

Before installing, be aware that this skill depends on yt-dlp from Homebrew or pip, so use a trusted package source or pin a reviewed version if that matters in your environment. It may save transcripts and preferences under ~/youtube-video-transcript/ only after consent; do not provide browser cookies unless you intentionally want yt-dlp to access age-restricted content for a specific video.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: setup.md:16

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:7
• setup.md:16-18

Vulnerability Type: Unpinned executable dependency and insufficient supply-chain integrity controls
Risk Level: Medium

Complete Code Snippets:

SKILL.md:7:

yaml

metadata: {"clawdbot":{"emoji":"📺","requires":{"bins":["yt-dlp"]},"install":[{"id":"brew","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (Homebrew)"},{"id":"pip","kind":"pip","package":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (pip)"}],"os":["linux","darwin","win32"]}}

setup.md:16-18:

markdown

If not installed, offer to help:
- "I need yt-dlp to extract transcripts. Want me to help you install it?"
- Options: `brew install yt-dlp` (macOS) or `pip install yt-dlp`

Technical Analysis

The Skill permits installation of yt-dlp without specifying a reviewed version, dependency lockfile, package hash, or trusted package-index configuration. Consequently, the installed artifact is resolved dynamically at installation time. Its contents may differ from those present when the Skill was audited.

Python packages and their transitive dependencies can execute code during installation or subsequent invocation. Therefore, compromise of the upstream package, one of its dependencies, the configured package index, or the package delivery path could turn the documented installation step into arbitrary code execution. Unexpected future releases may also introduce incompatible or vulnerable behavior.

The Homebrew instruction is likewise not version-constrained, although the direct pip install yt-dlp path presents the clearest instance because it contains no lock or integrity-verification mechanism. No evidence was found that the current yt-dlp package is malicious; this finding concerns the absence of dependency integrity controls.

Attack Path

1. An attacker compromises a future yt-dlp release, a transitive depende ...[truncated 1258 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to a specifically reviewed version rather than installing the latest available release:

   bash

   python -m pip install "yt-dlp==REVIEWED_VERSION"
   

2. Record cryptographic hashes in a locked requirements file and require hash verification:

   text

   yt-dlp==REVIEWED_VERSION --hash=sha256:EXPECTED_ARTIFACT_HASH
   

   bash

   python -m pip install --require-hashes -r requirements.txt
   

3. Review and pin all transitive dependencies where applicable, using a reproducible dependency-locking workflow.
4. Explicitly configure and document a trusted package index instead of relying on arbitrary user-level pip configuration.
5. Install the dependency in an isolated virtual environment with the minimum required filesystem and account privileges.
6. Add a controlled update process in which new versions and artifact hashes are reviewed before changing the pin.
7. Apply equivalent provenance and version-control measures to the Homebrew installation path where practical.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The 'When to Use' section describes activation in very general terms such as when a user 'wants to read instead of watch' or 'wants to summarize a video,' but it does not define specific trigger phrases, scope limits, or exclusion conditions. In a skill-routing context, this can overlap with common requests and cause unintended invocation for generic summarization or research tasks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The instruction to 'Default to English' applies a language choice without user opt-in. This is a natural-language locale policy concern because the skill should offer a language choice or use a justified region-specific default rather than forcing English automatically.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

| Ignoring auto-generated quality | Garbage text with errors | Prefer manual, warn about auto |
| Losing timestamps | Can't navigate video | Never strip in any operation |
| Extracting without metadata | Missing title, chapters | Always fetch `-j` first |
| Caching without consent | Privacy violation | Ask before saving |

## Quick Commands

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Examples like 'Save this transcript' and 'Delete video X' are broad natural-language commands that could refer to many contexts, yet the document does not constrain them to this skill's YouTube transcript cache. Without narrowing context or exclusions, these phrases are ambiguous for automatic invocation.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · memory-template.md (reported line 84)May include surrounding context.

md

|-------|---------|----------|
| `caching_consent: pending` | Not asked yet | Ask on first use |
| `caching_consent: yes` | User agreed | Cache transcripts |
| `caching_consent: no` | User declined | Never cache without asking again |

## Transparency Principles

Static analysis

No suspicious patterns detected.