Security audit

YouTube Transcript

Security checks for vulnerabilities and agentic risk

Overview

This skill is a small YouTube URL parser/demo, but it exposes a credential-like API key and claims paid transcript functionality it does not implement.

Review before installing. Treat this package as a demo URL parser, not a working paid transcript service. The publisher should remove and rotate the exposed key, disclose any external provider and data sharing, implement transcript retrieval, and avoid returning paid status without real payment verification.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:39
Finding: Hardcoded API Key Exposed in Skill Documentation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 39 **Vulnerability Type**: Hardcoded credential exposure **Risk Level**: Medium ### Complete Code Snippet ```markdown - API Key: sk_93c5ff38cc3e6112623d361fffcc5d1eb1b5844eac9c40043b57c0e08f91430e ``` ### Technical Analysis A credential-like API key is embedded directly in a documentation file distributed with the skill. Documentation is normally readable by every user or process that can access the package, so it is not a suitable location for secrets. If the key is active, an attacker can extract it without executing the skill and attempt to authenticate to its associated service. The available evidence does not identify the service, permissions, validity, or expiration of the key; therefore, successful exploitation depends on whether the credential remains valid. ### Attack Path 1. Obtain read access to the skill package or its source repository. 2. Open `SKILL.md`. 3. Extract the plaintext API key from line 39. 4. Identify or infer the service associated with the credential. 5. If the key is valid, submit authenticated requests using the exposed credential. 6. Consume the associated quota, access data permitted to the key, or incur charges within the key's assigned scope. ### Impact Assessment No local system privileges are directly obtained from the documented key alone. If valid, the attacker may gain the remote API privileges assigned to it, potentially resulting in unauthorized service usage, quota exhaustion, financial loss, or access to data available through that API account. The scope is limited by the unknown permissions and restrictions configured for the key. ]]>
Remediation: <![CDATA[ ## Remediation Suggestions 1. Revoke and rotate the exposed API key immediately if it is genuine. 2. Remove the key from the current package and all accessible repository history. 3. Store operational credentials in environment variables or a dedicated secret manager. 4. Use a redacted placeholder such as `YOUR_API_KEY` in documentation. 5. Restrict replacement credentials by service, operation, source, quota, and expiration where supported. 6. Add automated secret scanning to pre-commit and CI workflows. 7. Review service logs for unauthorized use of the exposed credential. ]]>

other

Note

Location: handler.py:4
Finding: Unverified Payment Status and Misrepresented Transcript Functionality<![CDATA[ ## Vulnerability Details **File Location**: `handler.py`, lines 4–11; related claims in `SKILL.md`, lines 3–9 and 13–15 **Vulnerability Type**: Deceptive or unverified service state **Risk Level**: Low ### Complete Code Snippet ```python def handle(input_text: str, user_id: str = "default") -> dict: url_match = re.search(r'(youtube\.com/watch\?v=|youtu\.be/)([a-zA-Z0-9_-]{11})', input_text) if not url_match: return {"error": "Please provide a YouTube URL"} video_id = url_match.group(2) return {"video_id": video_id, "status": "Transcript service ready", "demo": "Use youtube-transcript-api library to fetch actual transcript", "payment_status": "paid"} ``` Related documented claims include: ```markdown ## Features - Auto-detect YouTube video URL - Fetch available transcripts - Support multiple languages - Return timestamps ## Price - **0.001 USDT** per transcript ``` ### Technical Analysis The handler only extracts an 11-character YouTube video ID. It does not contact YouTube or another transcript provider, retrieve subtitles, return timestamps, enumerate languages, perform a payment transaction, or verify payment state. Despite the absence of payment validation, every syntactically accepted URL receives `"payment_status": "paid"`. This creates an integrity flaw if another component treats the returned field as authoritative. The documented transcript and pricing behavior also does not match the implementation. The code does not demonstrate an actual payment-system compromise by itself because no payment or authorization mechanism is implemented in the reviewed package. Exploitation requires a downstream integration that trusts this response. ### Attack Path 1. Submit any input containing a supported YouTube URL with an 11-character video ID. 2. The handler validates only the URL pattern and extracts the video ID. 3. No payment token, transaction identifier, account balance, receipt, or provid ...[truncated 857 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not return `"payment_status": "paid"` unless a trusted payment provider has cryptographically or server-side verified the transaction. 2. Require a transaction identifier tied to the authenticated user, requested operation, expected amount, currency, and a unique request nonce. 3. Verify payment state through a trusted server-to-server API and reject replayed, expired, failed, or mismatched transactions. 4. Keep authoritative payment state on the server rather than accepting or synthesizing it from caller-controlled requests. 5. Implement transcript retrieval with explicit timeout, error handling, language selection, and a response matching the documented schema. 6. If the project is only a demonstration, remove pricing and payment claims, label the output as simulated, and replace `payment_status` with a non-authoritative field such as `"demo_mode": true`. 7. Add tests confirming that unpaid requests cannot produce a paid state and that successful responses contain actual transcript data. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The skill publishes a hardcoded API key directly in SKILL.md, exposing a secret to anyone who can view the file. This is unrelated to the user-facing transcript functionality and could allow unauthorized use of the backing service, quota theft, billing abuse, or pivoting into other systems if the key has broader scope.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The example trigger "Show video subtitles" is ambiguous because it does not explicitly mention YouTube, a URL, or other scope constraints. In a manifest-style markdown skill description, this can cause unintended invocation for generic subtitle-related requests rather than only YouTube transcript retrieval.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill does not warn users that provided YouTube URLs or video identifiers are sent to an external service to retrieve transcripts. This creates a privacy and transparency issue because users may not realize their request data is being disclosed to a third party, which is more concerning when combined with the exposed API integration details.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The file is labeled "YouTube Transcript", which indicates transcript retrieval capability. However, the implementation does not fetch or return any transcript data; it only parses a YouTube URL, extracts the video ID, and returns a demo/status payload saying a separate library should be used.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: SKILL.md:40