Security audit

Youtube Summary Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended to summarize YouTube transcripts, but its launcher can execute an unintended local cached script and resolves an unpinned Python dependency at runtime.

Install only if you are comfortable with a skill that runs Bash, fetches a Python package at runtime, contacts YouTube caption services, and can write a summary file after confirmation. Review or pin the dependency and prefer a deterministic script path before using it in a sensitive workspace.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:37
Finding: Unpinned Third-Party Package Is Resolved and Executed at Runtime
Content: View full analysis
Remediation: View remediation

T07 · Tool Hijacking and Spoofing

Error

Location: SKILL.md:37
Finding: Ambiguous Cache Search Can Execute an Unintended Python Script
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:43
Finding: Untrusted YouTube Transcript Content Is Not Isolated from Agent Instructions
Content: View full analysis
Notable quotes or significant phrases from the video (if any stand out) Translate section headings to match the chosen language (e.g., "Panoramica", "Punti chiave", "Citazioni notevoli" for Italian). If the transcript is in a different language than the chosen one, still produce the summary in the chosen language. ``` The skill also permits subsequent file writing: ```markdown 5. **Offer to save**: After presenting the summary, ask the user if they want to save it as a Markdown file. If yes, write it using the Write tool to a reasonable filename based on the video ID (e.g., `youtube_summary_.md`). ``` ### Technical Analysis YouTube captions are external, creator-controlled data. The fetcher concatenates caption snippets into a plain transcript string, and the skill directs the Agent to use that transcript for summarization. It does not explicitly identify the transcript as untrusted quoted data or instruct the Agent to ignore commands embedded in it. A malicious transcript co ...[truncated 2003 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The code accurately handles YouTube transcript extraction and language preference/fallback, which aligns with the transcript-fetching portion of the description. However, it never summarizes the transcript or produces any structured summary beyond returning raw transcript text in JSON. Since summarization is a core part of the declared primary purpose, this is a material description-behavior mismatch.
Content: No source excerpt is available for this finding.

Lp1

High

Category: MCP Least Privilege
Confidence: 75% confidence
Finding: The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
Or copy the files manually:

bash
mkdir -p ~/.claude/skills/youtube-summary-skill cp SKILL.md fetch_transcript.py ~/.claude/skills/youtube-summary-skill/

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 41)May include surrounding context.
Or copy the files manually:

bash
mkdir -p ~/.claude/skills/youtube-summary-skill cp SKILL.md fetch_transcript.py ~/.claude/skills/youtube-summary-skill/

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The default language preference is set to "it,en", which forces an Italian-first locale choice unless the user explicitly overrides it. This is a natural-language locale policy concern because the tool imposes a specific language preference by default rather than offering a neutral default or requiring user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: This markdown file states that the skill can optionally save the summary as a Markdown file, which affects user data and the local filesystem. The description does not include any warning or disclosure about where the file is written or that local files may be created.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.