Security audit

YouTube/B站视频搜索下载

Security checks for vulnerabilities and agentic risk

Overview

This looks like a video search/download skill, but it needs Review because it can automatically use browser login cookies and its docs overstate supported features.

Install only if you are comfortable with a media tool that writes downloads locally and may use your browser login cookies through yt-dlp. Prefer removing the automatic browser-cookie behavior, pinning dependencies, and using a dedicated low-privilege browser profile or explicit cookie file only when authenticated downloads are truly needed.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/yt_search.py:237
Finding: Automatic Browser Cookie Access Exceeds Least-Privilege Requirements
Content: View full analysis
Vulnerability Details

File Location: scripts/yt_search.py:237-242; related instructions in SKILL.md:145-150, 180-199
Vulnerability Type: Automatic access to sensitive browser authentication data
Risk Level: Medium

Code Snippet:

python
cmd_parts = ["yt-dlp"] # Try to use browser cookies for age-restricted or region-locked videos for browser in ["chrome", "firefox", "safari"]: if shutil.which(browser) or os.path.exists(f"/Applications/{browser.capitalize()}.app"): cmd_parts += ["--cookies-from-browser", browser] break

The documentation also repeatedly directs the agent to use browser cookies:

bash
yt-dlp --cookies-from-browser chrome \ --write-auto-sub --write-sub \ --sub-lang en,zh-Hans \ --convert-subs srt \ --skip-download \ -o "~/Downloads/%(title)s.%(ext)s" \ "VIDEO_URL"

Technical Analysis

The download implementation automatically passes --cookies-from-browser to yt-dlp whenever Chrome, Firefox, or Safari appears to be installed. Browser cookies are sensitive authentication material that can provide access to logged-in sessions, account-specific content, subscription data, and other authenticated platform features.

Reading browser cookies can be necessary for explicitly requested age-restricted, private, or region-restricted content. It is not necessary for ordinary public video or subtitle downloads. Applying this behavior to every download therefore violates least privilege.

The subprocess call uses an argument list rather than shell=True, so the reviewed code does not expose a direct shell-command injection path. The risk instead arises because a third-party executable receives access to browser credential storage without an explicit user decision for each operation.

Attack Path

A user asks the Skill to download a public video, audio track, or subtitle.

The Skill checks whether a supported browser app ...[truncated 1008 chars]
Remediation: View remediation
Remediation Suggestions

Remove automatic browser-cookie detection from the default download path.

Add an explicit option such as --browser-cookies chrome that is disabled by default.

Display a clear warning before cookie access, including which browser profile will be read and why authenticated access is required.

Attempt unauthenticated downloads first and request cookie access only when the platform reports that authentication is necessary.

Prefer a dedicated, low-privilege browser profile containing only the minimum session data required for video access.

Where practical, support an explicitly supplied cookie file with restrictive filesystem permissions rather than reading the user's primary browser profile.

Validate download URLs against an allowlist of supported HTTPS platform domains before enabling authenticated requests.

Update SKILL.md so that subtitle and playlist examples do not enable browser cookies by default.

Pin and verify the yt-dlp installation because the process is being entrusted with sensitive authentication material.

T08 · Insecure Dependencies

Warning

Location: README.md:18
Finding: Unpinned Third-Party Package Installation and Execution
Content: View full analysis
Vulnerability Details

File Location: README.md:18-21, 37-39; duplicated in SKILL.md:33-35
Vulnerability Type: Mutable and unverified third-party dependency installation
Risk Level: Medium

Code Snippet:

bash
npx skills add yt-search-download

bash
brew install yt-dlp # macOS pip install yt-dlp # alternative installation through pip

The Skill documentation contains the equivalent unpinned installation instruction:

bash
brew install yt-dlp # macOS pip install yt-dlp # alternative pip installation

Technical Analysis

These commands resolve mutable package or registry content without selecting a reviewed version or verifying integrity. In particular, npx may download and execute package code immediately. The unpinned pip install yt-dlp command installs whichever release the configured package index currently serves.

An unpinned dependency is not inherently malicious, and the audit found no evidence that the named packages are currently malicious or typosquatted. The security weakness is that the effective code can change after this Skill has been reviewed. A compromised registry account, dependency takeover, poisoned package index, or malicious future release could introduce code that was absent from the audited project.

This risk is amplified because yt-dlp is executed with network and filesystem access and, under the default implementation, may also receive permission to read browser cookie stores.

Attack Path

A user follows the documented npx or pip install command.

The package manager resolves the latest matching package from its configured registry or index.

A compromised publisher account, registry response, package index, or future package release supplies altered code.

For npx, fetched package code may execute as part of the command; for pip, the installed executable runs when the Skill performs a download.

...[truncated 799 chars]
Remediation: View remediation
Remediation Suggestions

Pin yt-dlp to a reviewed version rather than installing the latest available release.

For Python installation, provide a requirements file with exact versions and cryptographic hashes, and install with hash verification.

Document the expected package publisher and official repository so users can verify package provenance.

Pin the package used by npx to an exact reviewed version, or replace immediate remote execution with a verified installation process.

Use lockfiles where supported and review dependency updates before changing pinned versions.

Prefer isolated environments, such as a dedicated virtual environment or restricted container, for yt-dlp.

Verify the resolved yt-dlp executable before use rather than trusting the first matching executable in PATH.

Apply least-privilege restrictions to installed dependencies, especially by removing default browser-cookie access.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (17)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The manifest claims broader capabilities than the documented implementation, including Bilibili support and subtitle features not actually implemented in the referenced script. This mismatch can mislead reviewers and users about what the skill will do, which is dangerous when the skill also invokes shell commands, downloads files, and accesses browser-derived data outside the stated core logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented use of browser cookies for yt-dlp operations is privacy-sensitive credential access, yet the skill provides no warning or consent mechanism. In practice this can expose authenticated session data and enable access to account-scoped resources beyond what users expect from a search/download utility.
Content: No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

Category: YARA Match
Confidence: 99% confidence
Finding: The YARA hit is justified because the skill explicitly uses a browser-cookie extraction pattern commonly associated with credential harvesting. Even if intended for yt-dlp convenience rather than theft, the mechanism accesses sensitive browser-stored session data and therefore meaningfully raises the risk profile.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
iewCount -n 20`

提取播客音频：

search "播客名" -o date -n 5

download "URL" --audio-only

下载字幕（默认同时输出 SRT + TXT）

标准流程：下载字幕转为 SRT，同时生成保留时间戳的 TXT（供 AI 总结用，时间戳有助于定位内容）。

bash
# Step 1：下载字幕并转为 SRT（英文优先，无则用自动字幕） yt-dlp --cookies-from-browser chrome \ --write-auto-sub --write-sub \ --sub-lang en,zh-Hans \ --convert-subs srt \ --skip-download \ -o "~/Downloads/%(title)s.%(ext)s" \ "VIDEO_URL" # 输出：~/Downloads/视频标题.en.srt 或 .zh-Hans.srt # Step 2：从 SRT 生成 TXT（保留时间戳，仅去除序号和空行，供 AI 总结使用） python3 -c " import re, sys srt = open(sys.argv[1]).read() # 去除序号行（纯数字行），保留时间戳和字幕文本 txt = re.sub(r'^\d+\s*\n', '', srt, flags=re.MULTILINE) txt = re.sub(r'\n{3,}', '\n\n', txt).strip() txt_path = sys.argv[1].re

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The download routine automatically attempts to read cookies from local browsers and pass them to yt-dlp, which grants the tool access to authenticated browser session data without an explicit user opt-in. In a skill context, this is more dangerous because a seemingly simple media-download request can silently leverage private session state, enabling access to age-restricted/private content and exposing sensitive authentication material to an external tool.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The phrase '搜索结果为英文时自动附加中文译名' indicates the skill will automatically add Chinese translations when results are in English. This is a natural-language locale policy issue because it forces a specific language behavior without documenting user choice or opt-in.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to install the skill via npx skills add yt-search-download without pinning a specific version. This creates a supply-chain risk: users may fetch whatever version is current at execution time, including a compromised or maliciously replaced release. Because this is an install command in documentation, it directly influences how users obtain and trust executable content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents shell, network, and environment-variable access but declares no tool scope or permission boundaries. That increases the chance an agent can invoke sensitive capabilities implicitly, reducing reviewability and making accidental or unsafe execution more likely.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases are broad enough that ordinary conversation about YouTube/B站 browsing or downloading could activate the skill unintentionally. In this skill's context, unintended activation is risky because the documented behavior includes shell execution, network access, and local file writes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill describes downloading media and writing outputs to local directories like ~/Downloads or user-specified paths without clear user-facing warnings. Silent or implicit local file creation can lead to surprise disk usage, overwrites, or storage of copyrighted/sensitive content on the user's machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instructions say the AI must replace every placeholder with Chinese translation and explicitly must not ask the user whether translation is needed. This imposes a language preference without opt-in or offering alternatives, which is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The subtitle workflow instructs the tool to extract cookies from the user's Chrome browser via --cookies-from-browser chrome. Browser cookies are authentication material; pulling them into a command-line workflow materially expands the skill from media handling into access to sensitive credentials and logged-in session state.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module documentation and all implemented search, channel, and info logic are specific to YouTube Data API v3, with YouTube-only URL construction and video ID parsing elsewhere in the file. This does not match the manifest's stated support for multiple sites such as B站/Bilibili, creating a user-facing capability mismatch.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This code emits user-facing messages, table headers, CLI descriptions, and errors in Chinese throughout the script, such as at the channel search error, result rendering, and argparse help text. Because the file does not provide any language selection, opt-in, or justification for a Chinese-only locale, it violates the natural-language locale policy criteria.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/yt_search.py (reported line 265)May include surrounding context.
python
print(f"\n▶ 开始下载: {url}") print(f" 保存到: {out}\n") result = subprocess.run(cmd_parts, capture_output=False) if result.returncode != 0: print(f"\n[错误] 下载失败 (退出码 {result.returncode})", file=sys.stderr) return False

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI exposes only search, channel, download, and info subcommands, and the download path does not add any yt-dlp subtitle options. Since subtitles are a named core capability in the manifest, their absence is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: This markdown file documents operations that save videos, MP3s, SRTs, and TXT files to the user's system, but it does not include any explicit warning that the skill will create files or consume local storage/bandwidth. For markdown files, SQP-2 applies when the skill description omits warnings about behaviors that could affect user data or system integrity.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest enumerates search, channel browsing, single-video download, audio extraction, subtitle download, and video detail lookup. The advanced example adds downloading an entire playlist, which is a materially broader bulk-download capability not mentioned in the declared scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T05 · Unauthorized Access and Privilege Escalation

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

T08 · Insecure Dependencies

Vulnerability Details

Technical Analysis

Attack Path

Remediation Suggestions

SkillSpector

Tp4

Missing User Warnings

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

下载字幕（默认同时输出 SRT + TXT）

Context-Inappropriate Capability

Natural-Language Policy Violations

Rp1

Undeclared Tool Scope

Vague Triggers

Missing User Warnings

Natural-Language Policy Violations

Context-Inappropriate Capability

Description-Behavior Mismatch

Natural-Language Policy Violations

subprocess module call

Description-Behavior Mismatch

Missing User Warnings

Context-Inappropriate Capability

Static analysis