YouTube Shorts 자동 생성

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:51 PM UTC
• Version: 2.0.1

Overview

This skill has a coherent YouTube Shorts purpose, but installation depends on running unreviewed mutable code from an external GitHub repository.

Review this skill before installing. Its media-generation and upload behavior matches its stated purpose, but only SKILL.md is packaged for review; the real code is pulled from GitHub and executed with your local permissions. Install only in an isolated environment, inspect the cloned repository and setup script first, keep Gemini and YouTube credentials limited, and do not use --auto or --upload unless you intend to spend API credits and publish or upload content.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:29

Finding

Execution of Mutable Code Retrieved from an Unpinned Remote Repository

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 29-33
Vulnerability Type: Remote payload retrieval and execution
Risk Level: High

bash

git clone https://github.com/kangjjang/youtube-shorts-skill.git
cd youtube-shorts-skill
bash scripts/setup.sh

Technical Analysis

The installation instructions clone the current contents of an external GitHub repository and immediately execute its scripts/setup.sh file. The repository is not pinned to an immutable commit, and the instructions do not require signature or checksum verification.

Consequently, the effective code executed by the Skill can change after this artifact has been reviewed. The referenced setup script is not included in the audited artifact, so its operations cannot be inspected or verified. If the upstream repository, its maintainer account, or its default branch is compromised, attacker-controlled shell commands would be executed with the invoking user's privileges.

The later environment setup also runs pip install -r requirements.txt from the remotely retrieved repository. This increases the supply-chain exposure because neither the dependency manifest nor pinned dependency hashes are present in the audited artifact.

Attack Path

1. An attacker compromises the upstream repository, its maintainer account, or a dependency referenced by the remote project.
2. The attacker modifies scripts/setup.sh, the dependency manifest, or another installation component on the repository's default branch.
3. A user follows the Skill instructions and clones the latest mutable repository state.
4. The user executes bash scripts/setup.sh without verifying the retrieved content.
5. The attacker's commands execute under the user's account and can use that account's filesystem and network access.
6. If sensitive environment variables such as GEMINI_API_KEY are available to the process, malicious installation code may read and transmit them ...[truncated 589 chars]

Remediation

View remediation

Remediation Suggestions

1. Include all reviewed source code and installation scripts directly in the Skill package so the audited artifact is self-contained.
2. If remote retrieval is unavoidable, pin the repository to a specific immutable commit hash rather than cloning the mutable default branch.
3. Distribute signed releases and verify the release signature and cryptographic checksum before executing any downloaded file.
4. Require users to inspect the retrieved setup script before execution and avoid piping or immediately passing unverified remote content to a shell.
5. Pin Python dependencies to exact versions and hashes using a lock file or hash-verified requirements file.
6. Run installation in an isolated, least-privileged environment without unnecessary credentials, including GEMINI_API_KEY.
7. Apply restricted filesystem and network permissions during installation, allowing access only to resources necessary for setup.
8. Document the exact reviewed repository commit and dependency lock-file digest in SKILL.md.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The description states that the skill automatically generates 60-second Korean-language YouTube Shorts. There is no indication that users can opt into another language or that the Korean-only restriction is required for a documented regional or compliance reason.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases are broad enough to match common conversational requests like 'make shorts' or 'collect trends,' which can cause this skill to activate unexpectedly. In this skill, accidental activation is more concerning because execution can lead to networked content generation, local file creation, API usage, and potentially publishing workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill documents commands that can upload videos and create output artifacts, but it does not prominently warn users that running the workflow may publish to YouTube or produce files under outputs/. In this context, the omission is risky because the pipeline also incurs API costs and performs external actions, so a user may trigger materially significant behavior without informed consent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.