Youtube Editor

• Analyzed: May 14, 2026, 3:37 AM
• Findings: 1
• Version: 1.0.14
• Hash: b075be551b16d59951c0821f7a86748035b968bcba55b086e9243a41845c75f2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to a local HTML injection (XSS) vulnerability in `scripts/process_video.py`. The `avatar_path` argument, which can be user-controlled, is directly embedded into an `<img>` tag's `src` attribute within an HTML template without proper HTML escaping. This could allow a malicious user to inject arbitrary JavaScript into the locally rendered HTML, which is then processed by Playwright. While the skill demonstrates good security practices like YouTube URL validation and safe subprocess execution for other features, this specific input sanitization oversight presents a vulnerability.