Youtube Transcription Generator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 4:41 PM UTC
• Version: 0.1.0

Overview

This skill matches its stated YouTube transcription purpose, but it needs review because it relies on unpinned external tools and third-party video processing without clear user-facing disclosure.

Review before installing. Use a clean virtual environment, inspect or supply your own pinned dependency file, and only transcribe videos you are allowed to download and comfortable sending to VLM Run for processing. Do not expose unrelated secrets in the shell or .env file used for this task.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:60

Finding

Unpinned and Unverifiable Third-Party Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 60-67, 121-127
Vulnerability Type: Insecure third-party dependency installation
Risk Level: Medium

Vulnerable Code

powershell

cd path\to\youtube-transcription-generator
uv venv
.venv\Scripts\Activate.ps1
uv pip install -r requirements.txt

bash

cd path/to/youtube-transcription-generator
uv venv
source .venv/bin/activate
uv pip install -r requirements.txt

bash

uv pip install "vlmrun[cli]"

bash

uv pip install -U yt-dlp

Technical Analysis

The Skill instructs users or agents to install and execute third-party Python packages without specifying exact versions or package integrity hashes. The referenced requirements.txt is absent from the audited project, so its dependency names, versions, transitive dependencies, and sources cannot be verified.

The troubleshooting guidance also recommends installing vlmrun[cli] without a version constraint and upgrading yt-dlp to the latest available release. Consequently, the code installed by these commands can change after the Skill has been reviewed. Python packages and their installation hooks may execute code with the privileges of the invoking user.

This creates supply-chain exposure to compromised package releases, compromised package repositories, dependency confusion, typosquatting in an unavailable requirements file, and malicious or unexpectedly changed transitive dependencies.

Attack Path

1. An attacker compromises a referenced package, one of its transitive dependencies, or the package distribution channel.
2. Alternatively, an attacker publishes a package matching an ambiguously sourced or otherwise unsafe dependency name contained in the unavailable requirements.txt.
3. A user or agent follows the Skill instructions and runs an unpinned uv pip install or upgrade command.
4. The package manager resolves and downloads the attacker-controlled or compromised release.
5. Package installation hoo ...[truncated 1053 chars]

Remediation

View remediation

Remediation Suggestions

1. Add the referenced requirements.txt or, preferably, a lockfile to the project so all direct and transitive dependencies can be audited.
2. Pin every dependency to an exact reviewed version rather than allowing unconstrained resolution.
3. Require package hashes, such as with a hash-locked requirements file, and make installation fail if integrity verification fails.
4. Configure an explicit trusted package index and prevent fallback to untrusted or unintended indexes.
5. Remove the automatic uv pip install -U yt-dlp recommendation. Document a reviewed version and a controlled upgrade process instead.
6. Pin vlmrun[cli] to a reviewed version and audit its optional CLI dependencies.
7. Regenerate lockfiles and review release changes before upgrading dependencies.
8. Run installation and transcription in a minimally privileged virtual environment or isolated container, exposing only necessary files and credentials.
9. Include all referenced scripts and configuration templates in the project so their behavior can be audited before execution.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the assistant to download YouTube media and submit it to vlmrun, an external transcription service, but it does not clearly warn the user that the video content will leave the local environment and be processed by a third party. This can cause unintentional disclosure of sensitive, copyrighted, private, or regulated content if a user assumes the transcription happens locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.