Security audit

Baoyu Youtube Transcript

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly does what it says, but it can automatically run mutable third-party tooling and remote executable components in ways users should review before installing.

Review this skill before installing. Use it only in an environment where running yt-dlp and Bun subprocesses is acceptable, prefer preinstalled pinned binaries, avoid `npx`/`uvx` fallback execution, and do not set `YOUTUBE_TRANSCRIPT_COOKIES_FROM_BROWSER` unless you understand that browser session cookies may be used by the fallback process.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T08 · Insecure Dependencies

Error

Location: SKILL.md:22
Finding: Unpinned Bun Package Download and Execution via npx
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: scripts/youtube.ts:286
Finding: Automatic Execution of Unpinned yt-dlp Through uvx
Content: View full analysis
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: scripts/youtube.ts:366
Finding: Runtime Retrieval and Execution of Mutable Remote Components
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The description presents a skill whose core function is to download YouTube transcripts/subtitles and cover images, with additional capabilities like translation, speaker identification, and caching. The supplied code chunk is instead a transcript parsing/formatting utility: it parses subtitle formats, segments text, formats Markdown/SRT output, lists available transcripts, and picks transcripts by language. Some declared areas are partially related: chapters are supported in formatting, multiple languages are supported in transcript selection/listing, and cover-image URLs can be included in generated Markdown if already present in metadata. However, key declared capabilities are absent from this code chunk: no network retrieval/download logic, no cover-image extraction/download, no caching, and no actual speaker identification. Therefore the supplied code does not accurately represent the declared end-to-end behavior, and there is a meaningful description-versus-behavior mismatch.
Content: No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
md
d transcripts | | | `--exclude-manually-created` | Skip manually created transcripts | | | `--refresh` | Force re-fetch, ignore cached data | | | `-o, --output <path>` | Save to specific file path | auto-generated | | `--output-dir <dir>` | Base output directory | `youtube-transcript` | ## Optional Environment Variables | Variable | Description | |----------|-------------| | `YOUTUBE_TRANSCRIPT_COOKIES_FROM_BROWSER` | Passed to `yt-dlp --cookies-from-browser` during fallback, e.g. `chrome`, `safari`, `firefox`, or `chrome:Profile 1` | ## Input Formats Accepts any of these as video input: - Full URL: `https://www.youtube.com/watch?v=dQw4w9WgXcQ` - Short URL: `https://youtu.be/dQw4w9WgXcQ` - Embed URL: `https://www.youtube.com/embed/dQw4w9WgXcQ` - Shorts URL: `https://www.youtube.com/shorts/dQw4w9WgXcQ` - Video ID: `dQw4w9WgXcQ` ## Output Formats | Format | Extension | Description | |--------|-----------|-------------| | `text` | `.md` | Markdown with frontmatter (incl. `descriptio

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares executable behavior that uses environment variables and network access, but it provides no explicit tool scope or permission boundaries. That increases the chance an agent will invoke networked code or read env-backed settings without clear policy review, which is risky for a skill that also documents cookie-based fallback behavior.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: Using npx -y bun without pinning a specific version allows execution of whatever package version is current at runtime. This creates a supply-chain risk: a compromised or breaking upstream release could change behavior or execute malicious code when the skill runs.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documented --cookies-from-browser fallback can access browser session cookies and use them in outbound requests, but the skill does not clearly warn about the sensitivity of that action. Because browser cookies may grant authenticated access, this behavior materially raises privacy and account-security risk if triggered without informed consent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Telling the agent to make yt-dlp available on its own if missing authorizes environment modification or tool installation beyond the stated task. That can lead to unreviewed package installation, expanded execution surface, and inconsistent security posture across hosts.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs the agent to spawn a separate AI sub-agent and overwrite transcript files, expanding the trust boundary beyond simple transcript retrieval. This introduces prompt-injection and integrity risks because untrusted transcript/description content may influence downstream processing and cause destructive or misleading file modifications.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Line L015 requires the title and table of contents to use the same language as the transcription, and the broader instructions in L021 reinforce a strict no-translation rule. This imposes a language behavior without user opt-in or a documented policy justification, which matches the language/locale policy violation criteria.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The code hard-codes English locale parameters and headers such as hl=en, persist_hl=1, and Accept-Language: en-US,en;q=0.9 when fetching YouTube pages. Similar fixed locale values recur elsewhere, which can violate language/locale policy because the skill does not offer users a locale choice or document a justified region-specific constraint.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The InnerTube request context explicitly sets hl: "en" and gl: "US", which forces a specific language and geographic locale. There is no visible mechanism for user selection or opt-in, so this is a natural-language policy concern under the locale rule.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This skill advertises transcript and thumbnail retrieval, but the fallback path invokes a local subprocess with broad executable capability. Even though arguments are mostly fixed, introducing external process execution materially expands the trust boundary and attack surface beyond simple HTTP retrieval, especially because the subprocess may execute complex extractor logic and remote components.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The fallback command uvx --from yt-dlp yt-dlp pulls and executes a package by name without a pinned version or integrity control. That creates a supply-chain execution path where a compromised upstream release or unexpected version change can lead to arbitrary code execution in the local environment when the skill is used.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code reads YOUTUBE_TRANSCRIPT_COOKIES_FROM_BROWSER from the environment and passes it to yt-dlp, enabling use of browser-derived authenticated cookies. This extends the skill from public transcript retrieval into access using local user credentials, which can expose private/account-scoped content and increases the sensitivity of the subprocess execution path.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: downloadCoverImage fetches remote image data and writes it directly to outputPath via writeFileSync, but this function has no confirmation prompt, comment, docstring, or user-facing log indicating that it writes to the local filesystem. For code files, file writes should have some visible disclosure unless clearly covered elsewhere, which is not evident in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documents persistent local caching of transcripts, metadata, descriptions, and thumbnails without clearly warning the user that this data will be stored on disk. This can create privacy and data-retention issues, especially if transcripts or metadata are sensitive or stored in shared environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The script fetches video source, transcript data, and cover images from external sources, which involves transmitting the requested video identifier and downloading remote content. Although this is functionally expected for a transcript-fetching tool, this file does not include any explicit warning or help-text disclosure about network access or downloads.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This code persistently writes transcript data, sentence data, metadata, and an image into a cache/output directory using multiple writeFileSync calls. While the CLI exposes output-path options, there is no confirmation prompt or explicit user-facing disclosure in this file that running the command will create and retain local copies of fetched content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This code propagates meta.language.code into the generated markdown front matter, which can reinforce a specific language/locale designation in output without any visible user opt-in or fallback choice in this file. Under the policy rule, locale-related behavior should either be optional for the user or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/youtube.ts:293