Youtube Editor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:20 AM UTC
• Version: 1.0.14

Overview

The skill’s YouTube-editing purpose is coherent, but it needs Review because it runs unpinned dependencies, invokes another local skill, and can expose an optional image API key through a child-process command line.

Review before installing. Run it only in an isolated project directory, use narrowly scoped API keys, avoid enabling the optional image-generation path until the key handling is fixed, review any installed `nano-banana-pro` skill separately, and avoid untrusted avatar filenames or paths. Prefer a release with pinned dependencies, a lockfile, escaped thumbnail asset paths, and environment-based secret passing to child processes.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Error

• Location: scripts/process_video.py:1

Finding

Unpinned Runtime Dependencies Create a Supply-Chain Execution Risk

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/process_video.py:173

Finding

NANO_BANANA_KEY Is Exposed in a Child Process Command Line

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/process_video.py:214

Finding

Unescaped Avatar Path Allows Markup Injection into the Thumbnail Document

Content

View full analysis

' ``` The generated document is subsequently opened in Chromium: ```python with sync_playwright() as p: browser = p.chromium.launch() page = browser.new_page(viewport={"width": 1280, "height": 720}) page.goto(f"file://{os.path.abspath(html_path)}") page.screenshot(path=output_file) ``` ### Technical Analysis The code correctly applies `html.escape` to the title, subtitle, and author fields, but it does not escape the avatar path before inserting it into a double-quoted HTML attribute. An existing avatar filename can contain quotation marks and HTML metacharacters on supported filesystems. A crafted path can therefore terminate the `src` attribute and inject additional attributes or markup into the generated document. The HTML is then loaded as a local `file://` document in a Playwright-controlled Chromium instance. The browser context is launched without an explicit JavaScript restriction, request interception policy, or outbound-network restriction. Injected active content supported by Chromium could execute in that temporary browser context or cause attacker-controlled network requests. Browser security controls may limit direct access to unrelated local resources, but they do not make raw HTML injection safe. ### Attack Path 1. An attacker creates or supplies an otherwise valid avatar image whose filename contains a double quote followed by attacker-controlled HTML markup. 2. The user invokes the Skill with that path through `--avatar`. 3. The script verifies only that the path exists. 4. The absolute path is interpolated into the `src` attribute without attribute escaping. 5. ...[truncated 831 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The markdown states that GPT-4 creates SEO-optimized titles, descriptions, and tags specifically in Korean. This is a natural-language locale constraint presented as a default behavior, with no indication that users can choose another language or opt in to Korean output.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md

- **🎨 AI Thumbnails (Pro):**
    - **Consistent Character:** Maintains the style of your avatar (or the default Pirate Lobster) while generating new poses! (Image-to-Image)
    - **Custom Fonts:** Paperlogy ExtraBold included.
    - **Background Removal:** Automatically removes background from the generated character.
    - **Layout:** Professional Black & Gold design.
- **🛡️ Security Hardening (v1.0.11):**
    - YouTube URL allowlist validation (blocks localhost/private-network targets)

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/process_video.py (reported line 69)May include surrounding context.

python

output_audio
    ]
    try:
        subprocess.run(cmd, check=True, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, timeout=900)
    except FileNotFoundError:
        print("Error: FFmpeg not found. Please install ffmpeg.")
        exit(1)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The prompt explicitly requires generated metadata to be in Korean and reiterates that all text output must be Korean. This is a natural-language locale policy constraint with no user opt-in or documented region-specific justification in the file.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

This subprocess executes another local skill script via uv run, effectively creating a cross-skill trust boundary without validating the integrity or provenance of the target script. If an attacker can place or modify the referenced nano-banana-pro skill in one of the searched locations, running this script will execute attacker-controlled code with the current user's privileges and access to provided API keys.

Content

Scanner excerpt · scripts/process_video.py (reported line 181)May include surrounding context.

python

try:
        # SECURITY: Timeout prevents runaway processes
        subprocess.run(cmd, check=True, timeout=900)
        return True
    except subprocess.CalledProcessError:
        print("⚠️ Image generation failed.")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The description emphasizes full Korean support as a headline feature, and elsewhere the content generation is described as Korean-specific. Taken together, this suggests a locale policy constraint without user opt-in or a clearly documented regional-only purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The generate_image docstring/documentation states that the API key is read from environment variable NANO_BANANA_KEY, which is true for that helper, but the overall script also depends on OPENAI_API_KEY for transcription and analysis. This creates intent/documentation divergence because the surrounding documentation can mislead a reviewer about what secrets the script actually uses.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.