T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:32- Finding
Unverified Remote Installer Executed Directly by the Shell
- Content
View full analysis
- Remediation
View remediation
Security audit
Youtube → Pocket Casts
Security checks for vulnerabilities and agentic risk
Overview
The skill appears to perform its stated upload workflow, but it asks users to handle long-lived account credentials and runs unpinned external code with access to those credentials.
Install only if you are comfortable storing a Pocket Casts refresh token and YouTube cookies locally and letting the script's runtime tools access them. Prefer reviewing or pinning the external tools first, avoid running it with elevated privileges, keep the credentials directory locked down, rotate/revoke the token and cookies if logs or files are exposed, and use it only for media you have rights to download and upload.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)
T08 · Insecure Dependencies
Error
- Location
scripts/upload.sh:66- Finding
Unpinned Third-Party Package Is Downloaded and Executed at Runtime
- Content
View full analysis
/dev/null) || { warn "Failed to get video info. YouTube may require cookies." warn "Export cookies from your browser using a browser extension like 'Get cookies.txt LOCALLY'" warn "Save the file as: $COOKIES_FILE" err "Download failed" } ``` ```bash uvx yt-dlp "${YTDLP_ARGS[@]}" "$VIDEO_URL" --remux-video mp4 -o "$OUTPUT_FILE" --no-playlist || err "Failed to download video" ``` ### Technical Analysis The script invokes `yt-dlp` through `uvx` without specifying a reviewed version or validating package artifacts. `uvx` can resolve, retrieve, and execute Python package code at runtime. Consequently, the code that runs may change between invocations even when the Skill itself has not changed. The package executes in the user's security context. When YouTube cookies are configured, the script explicitly passes the sensitive cookie file to the package through `--cookies`. A malicious or compromised dependency release could therefore read and exfiltrate authenticated YouTube session cookies. It could also inspect the default credentials hierarchy and access the Pocket Casts refresh token because no process isolation prevents it from reading other user-accessible files. There is no evidence that the current `yt-dlp` package is malicious. The vulnerability is the absence of version and artifact integrity controls around runtime dependency execution. ### Attack Path 1. An attacker compromises the upstream package account, package index, publishing pipeline, or dependency resolution path. 2. A malicious release is published under the ...[truncated 1003 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/upload.sh:8- Finding
Predictable Shared Temporary Paths Permit Symlink and File-Clobbering Attacks
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 92% confidence
- Finding
The skill clearly instructs users to run a shell script and install command-line tools, but it does not declare any corresponding permissions. Undeclared shell capability weakens transparency and review controls, making it easier for a skill to execute local commands or process files without users understanding the operational risk.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
The skill is designed to access and use sensitive authentication material, including a Pocket Casts refresh token and YouTube cookies, to obtain access tokens and perform uploads. Even though this appears functional rather than malicious, handling long-lived tokens and browser cookies increases the blast radius if the script, logs, or credential storage are compromised.
- Content
md ## How It Works 1. Downloads video via `yt-dlp --remux-video mp4` 2. Refreshes Pocket Casts access token using stored refresh token 3. Requests presigned upload URL from Pocket Casts API 4. PUTs file to S3 via presigned URL 5. Deletes local video file
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
If token refresh fails, the script includes the full TOKEN_RESPONSE in the error message. API error bodies can contain sensitive authentication material, account details, or debugging data, so echoing them to stderr may leak secrets into terminal history, logs, agent transcripts, or centralized monitoring systems.
- Content
sh --data-raw "{\"grantType\":\"refresh_token\",\"refreshToken\":\"$REFRESH_TOKEN\"}") ACCESS_TOKEN=$(echo "$TOKEN_RESPONSE" | jq -r '.accessToken') [[ -n "$ACCESS_TOKEN" && "$ACCESS_TOKEN" != "null" ]] || err "Failed to get access token: $TOKEN_RESPONSE" log "Got access token"
Static analysis
No suspicious patterns detected.