T09 · Insecure Skill Coding Practices
Error
- Location
scripts/summarize.py:544- Finding
Automatic Disclosure of Video Transcripts to an Anonymous Third-Party LLM
- Content
View full analysis
- Remediation
View remediation
Security audit
Video Summarizer
Security checks for vulnerabilities and agentic risk
Overview
This video summarizer is not clearly malicious, but it needs review because it can use browser login cookies and send transcript content to external AI services by default.
Review before installing. Use it only for public or non-sensitive videos unless you are comfortable sending transcript excerpts to configured LLM services or Pollinations. Avoid Bilibili mode unless you explicitly intend to let yt-dlp use Chrome cookies; preferably run it in an isolated environment or dedicated browser profile, remove the no-certificate-check option, and keep LLM_API_URL pointed only at a trusted endpoint.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/summarize.py:160- Finding
Unconditional Browser-Cookie Access with TLS Certificate Verification Disabled
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/summarize.py:474- Finding
Unvalidated Custom LLM Endpoint Can Receive Bearer Credentials and Transcript Data
- Content
View full analysis
Optional[str]: try: import requests headers = { "Content-Type": "application/json", "Editor-Version": "vscode/1.95.0", "User-Agent": "GitHubCopilotChat/0.20.0" } if api_key: headers["Authorization"] = f"Bearer {api_key}" response = requests.post( api_url, headers=headers, json={ "model": model, "messages": [{"role": "user", "content": prompt}], "max_tokens": 2000 }, timeout=120 ) ``` ```python env_url = os.environ.get("LLM_API_URL") env_key = os.environ.get("LLM_API_KEY") env_model = os.environ.get("LLM_MODEL", "gpt-4o-mini") if env_url and env_key: print(f" 🔑 Using LLM_API_URL env var: {env_url}", file=sys.stderr) result = _call_llm(env_url, env_key, env_model, prompt) if result: return result oc_token = os.environ.get("OPENCLAW_GATEWAY_TOKEN") if oc_token: api_url = env_url or "http://localhost:18789/v1/chat/completions" print(f" 🔑 Using OPENCLAW_GATEWAY_TOKEN → {api_url}", file=sys.stderr) result = _call_llm(api_url, oc_token, env_model, prompt) if result: return result ``` ### Technical Analysis `LLM_API_URL` is accepted directly from the environment without validating its scheme, destination host, port, or redirect behavior. `_call_llm()` then attaches a bearer credential and sends the complete summary prompt to that endpoint. This permits HTTPS endpoints, plaintext HTTP endpoints, or attacker-controlled hosts. It also means that when `OPENCLAW_GATEWAY_TOKEN` is s ...[truncated 1372 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
setup.sh:38- Finding
Unpinned Third-Party Dependencies Are Installed and Executed
- Content
View full analysis
- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/summarize.py:54- Finding
Untrusted Transcript Content Is Embedded Directly into LLM Instructions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (33)
Tainted flow: 'url' from requests.get (line 114, network input) → subprocess.run (code execution)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.
- Content
python url = f"https://www.youtube.com/@{channel_id}/videos" try: result = subprocess.run( [ "yt-dlp", "--flat-playlist",
Tainted flow: 'gh_token' from os.environ.get (line 525, credential/environment) → requests.get (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python def get_copilot_session_token(gh_token: str) -> Optional[str]: try: import requests r = requests.get( "https://api.github.com/copilot_internal/v2/token", headers={ "Authorization": f"token {gh_token}",
Tainted flow: 'api_url' from os.environ.get (line 519, credential/environment) → requests.post (network output)
Critical
- Category
- Data Flow
- Confidence
- 97% confidence
- Finding
The skill allows LLM_API_URL to fully control the outbound endpoint while also attaching a bearer token and sending transcript content. In an agent environment, a malicious user or wrapper can point this to an attacker-controlled server and cause credential leakage plus exfiltration of potentially sensitive transcript data.
- Content
python } if api_key: headers["Authorization"] = f"Bearer {api_key}" response = requests.post( api_url, headers=headers, json={
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
- Category
- YARA Match
- Confidence
- 94% confidence
- Finding
The use of --cookies-from-browser chrome causes the tool to access browser-stored authentication material and hand it to a downloader, which is highly sensitive behavior. While likely intended to bypass Bilibili restrictions rather than steal credentials, this is still dangerous in a skill because it leverages ambient local secrets without strong user awareness or limitation.
- Content
python .path.join(output_dir, f"bili_{video_id}_audio.mp3") frames_dir = os.path.join(output_dir, f"bili_{video_id}_frames") transcript_path = os.path.join(output_dir, f"bili_{video_id}_transcript.txt") print(f"🎬 Bilibili: {video_id}", file=sys.stderr) # Step 1: Download video print(" 📥 Downloading video...", file=sys.stderr) download_cmd = [ "yt-dlp", "--cookies-from-browser", "chrome", "--no-check-certificates", "-f", "bestvideo[height<=720]+bestaudio/best[height<=720]", "--merge-output-format", "mp4", "-o", video_path, url, ] subprocess.run(download_cmd, check=True, timeout=300) # Step 2: Extract audio print(" 🎵 Extracting audio...", file=sys.stderr) subprocess.run([ "ffmpeg", "-y", "-i", video_path, "-vn", "-acodec", "libmp3lame", "-q:a", "2", audio_path, ], check=True, timeout=120, capture_output=True) # Step 3: Whisper transcription print
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Using --no-check-certificates disables TLS certificate verification for yt-dlp downloads, allowing man-in-the-middle interception or tampering of retrieved video content. In combination with browser-cookie reuse, this materially increases the risk of session misuse, content poisoning, or credential exposure on hostile networks.
- Content
python download_cmd = [ "yt-dlp", "--cookies-from-browser", "chrome", "--no-check-certificates", "-f", "bestvideo[height<=720]+bestaudio/best[height<=720]", "--merge-output-format", "mp4", "-o", video_path,
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The README states the skill only supports YouTube, while the broader skill metadata says it is multi-platform and mentions Bilibili. This inconsistency can cause an agent or operator to invoke the skill with unsupported assumptions, leading to incorrect routing, unexpected failures, or accidental handling of data through unintended code paths.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation includes an explicit Bilibili URL example even though the README says the skill only supports YouTube. In agent ecosystems, examples are often treated as operational guidance, so this mismatch can trigger unsupported execution paths, user confusion, or misprocessing of external content.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README describes sending transcripts and summaries to external LLM endpoints and downstream messaging platforms, but provides no privacy, consent, retention, or data-handling warning. Video transcripts may contain personal, sensitive, copyrighted, or confidential information, so users may unknowingly exfiltrate content to third-party services.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 96% confidence
- Finding
The skill advertises capabilities that include environment access, file read/write, network, and shell execution, but it does not declare any explicit tool scope or permissions boundaries. In an agent ecosystem, this weakens policy enforcement and makes it easier for the skill to be invoked with broader privileges than users expect, especially given it downloads content, writes files, and may call external services.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The description is broad enough to trigger on generic summarization or digest requests, which can cause over-invocation of a skill that performs network access, local file writes, transcript extraction, and external summarization. That increases the chance an agent uses this skill in situations where a simpler or safer summarizer would suffice, exposing local and remote side effects unexpectedly.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The primary explanatory content begins in Chinese and the document does not indicate that users may choose their preferred language. For organizational language policy, forcing a specific language without opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill generates summaries through LLM APIs and explicitly supports custom endpoints and anonymous Pollinations calls, but it does not clearly warn that video-derived content such as transcripts, titles, metadata, and possibly frame descriptions may be transmitted to third parties. This creates a privacy and data-handling risk, especially for non-public, sensitive, or copyrighted material.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
Linux（当前已支持）
bash sudo apt install ffmpeg pip install faster-whisper yt-dlp youtube-transcript-api innertube
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The implementation performs significantly more than lightweight transcript extraction: it downloads full videos, writes media/transcript artifacts to disk, and generates frames. In an agent skill, that broader behavior increases privacy and storage exposure because users may not expect large local artifacts or retained content from a summarization request.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The script reads browser cookies from Chrome and uses environment tokens to access external services, which goes beyond ordinary transcript extraction and creates access to sensitive local credentials. In a skill context, this is especially dangerous because users may invoke summarization without realizing the tool will reach into browser state and reuse ambient secrets.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python "-o", video_path, url, ] subprocess.run(download_cmd, check=True, timeout=300) # Step 2: Extract audio print(" 🎵 Extracting audio...", file=sys.stderr)
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python # Step 2: Extract audio print(" 🎵 Extracting audio...", file=sys.stderr) subprocess.run([ "ffmpeg", "-y", "-i", video_path, "-vn", "-acodec", "libmp3lame", "-q:a", "2", audio_path,
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The Whisper transcription call hard-codes language="zh", which imposes a specific language/locale behavior regardless of user preference or source content. This matches the policy category for language or locale constraints without user opt-in.
- Content
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python if not skip_frames: print(f" 🖼️ Extracting keyframes (every {frame_interval}s)...", file=sys.stderr) os.makedirs(frames_dir, exist_ok=True) subprocess.run([ "ffmpeg", "-y", "-i", video_path, "-vf", f"fps=1/{frame_interval}", "-q:v", "2", os.path.join(frames_dir, "frame_%03d.jpg"),
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python url = f"https://www.youtube.com/@{channel_id}/videos" try: result = subprocess.run( [ "yt-dlp", "--flat-playlist",
subprocess module call
Medium
- Category
- Dangerous Code Execution
- Confidence
- 70% confidence
- Finding
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
- Content
python def get_video_details(video_id: str) -> Optional[Dict]: """Get detailed video metadata using yt-dlp""" try: result = subprocess.run( [ "yt-dlp", "--no-warnings",
Tainted flow: 'url' from requests.get (line 114, network input) → requests.get (network output)
Medium
- Category
- Data Flow
- Confidence
- 88% confidence
- Finding
The code downloads caption content from a URL obtained from remote metadata without validating the destination host or scheme. If an upstream response is malicious or compromised, this can turn the skill into a server-side request gadget that fetches attacker-chosen resources and may expose internal network reachability or be abused for unexpected outbound requests.
- Content
python def _download_caption(url: str) -> Optional[str]: try: import requests r = requests.get(url, timeout=15) if r.status_code == 200 and r.text.strip(): return r.text except Exception:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python try: import requests r = requests.get( "https://api.github.com/copilot_internal/v2/token", headers={ "Authorization": f"token {gh_token}", "Editor-Version": "vscode/1.95.0",
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
This network transmission sends transcript content and possibly authentication credentials to an endpoint that may be user/environment-controlled. In agent deployments, unrestricted outbound transmission of prompt data to arbitrary APIs is dangerous because it enables both data exfiltration and secret disclosure.
- Content
python } if api_key: headers["Authorization"] = f"Bearer {api_key}" response = requests.post( api_url, headers=headers, json={
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
Transcripts are sent to external LLM endpoints without any explicit warning, approval step, or data-classification check. Video transcripts can contain private, copyrighted, regulated, or confidential information, so undisclosed transmission to third parties is a substantive privacy and compliance vulnerability in this context.
- Content
Static analysis
No suspicious patterns detected.