Security audit
Security checks across malware telemetry and agentic risk
TubeScribe appears to be a legitimate YouTube summarizer, but it needs review because a YouTube URL can trigger background agent processing with network access, local file writes, and local tool execution without a clear confirmation step.
Install only if you are comfortable with YouTube links starting background processing that fetches public YouTube data, writes local files, invokes local tools, and may send transcript/comment text through your agent model environment. Review setup.py before accepting optional downloads, avoid private or sensitive videos, and consider requiring explicit confirmation before processing each URL.
"""Check if a Python package is installed in system Python."""
import_name = import_name or package
try:
result = subprocess.run(
[sys.executable, "-c", f"import {import_name}"],
capture_output=True, timeout=10
)# 2. Check shared ML env
if os.path.exists(ml_env_python):
try:
result = subprocess.run(
[ml_env_python, "-c", "import torch, soundfile, numpy, huggingface_hub"],
capture_output=True, timeout=10
)venv_python = os.path.join(kokoro_dir, ".venv", "bin", "python")
if os.path.exists(venv_python):
try:
result = subprocess.run(
[venv_python, "-c", "from kokoro import KPipeline"],
capture_output=True, timeout=10, cwd=kokoro_dir
)python_path, kokoro_dir = get_python_for_kokoro()
if python_path and kokoro_dir:
try:
result = subprocess.run(
[python_path, "-c", "from kokoro import KPipeline; print('ok')"],
capture_output=True, timeout=10, cwd=kokoro_dir
)print(local_dir)
'''
try:
result = subprocess.run(
[mlx_python, "-c", code],
capture_output=True, text=True, timeout=15
)print(blend_path)
'''
try:
result = subprocess.run(
[mlx_python, "-c", code],
capture_output=True, text=True, timeout=30
))
print("OK")
'''
result = subprocess.run(
[mlx_python, "-c", code],
capture_output=True, text=True, timeout=300
)run_kwargs = {"capture_output": True, "text": True, "timeout": 300}
if os.path.exists(os.path.join(kokoro_dir, "kokoro", "__init__.py")):
run_kwargs["cwd"] = kokoro_dir
result = subprocess.run([kokoro_python, "-c", code], **run_kwargs)
if result.returncode == 0 and os.path.exists(wav_path):
if audio_format == "mp3":"""Check if a Python package is installed in system Python."""
import_name = import_name or package
try:
result = subprocess.run(
[sys.executable, "-c", f"import {import_name}"],
capture_output=True, timeout=10
)# 2. Check shared ML env
if os.path.exists(ml_env_python):
try:
result = subprocess.run(
[ml_env_python, "-c", "import torch, soundfile, numpy, huggingface_hub"],
capture_output=True, timeout=10
)venv_python = os.path.join(kokoro_dir, ".venv", "bin", "python")
if os.path.exists(venv_python):
try:
result = subprocess.run(
[venv_python, "-c", "from kokoro import KPipeline"],
capture_output=True, timeout=10, cwd=kokoro_dir
)# Normalize URL to standard format (fixes /live/, /shorts/, etc.)
normalized_url = normalize_youtube_url(url)
try:
result = subprocess.run(
["summarize", normalized_url, "--youtube", "auto", "--extract-only", "--timestamps"],
capture_output=True, text=True, timeout=120 # 2 min timeout for long videos
)print(local_dir)
'''
try:
result = subprocess.run(
[mlx_python, "-c", code],
capture_output=True, text=True, timeout=15
)print(blend_path)
'''
try:
result = subprocess.run(
[mlx_python, "-c", code],
capture_output=True, text=True, timeout=30
))
print("OK")
'''
result = subprocess.run(
[mlx_python, "-c", code],
capture_output=True, text=True, timeout=300
)| Option | Default | Description | |--------|---------|-------------| | `processing.subagent_timeout` | `600` | Seconds for sub-agent (increase for long videos) | | `processing.cleanup_temp_files` | `true` | Remove /tmp files after completion | ### Comment Options | Option | Default | Description |
56/56 vendors flagged this skill as clean.
No suspicious patterns detected.