YouTube Content

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:06 AM UTC
• Version: 1.0.0

Overview

The YouTube transcription skill is mostly coherent, but it needs Review because its default workflow reads Chrome browser cookies and can enable mutable remote components.

Install only if you are comfortable with an agent using local YouTube tooling and writing transcript files. Prefer unauthenticated public-video retrieval first, require explicit consent before any Chrome cookie use, consider a dedicated browser profile, avoid combining cookies with remote components, and pin dependencies in an isolated environment.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34

Finding

Unpinned Third-Party Dependencies Create a Mutable Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:43

Finding

Default Commands Extract Sensitive Chrome Session Cookies Without Demonstrated Need

Content

View full analysis

&1 | grep -E "(has |zh-CN|zh-Hans)" ``` ```bash /opt/homebrew/Caskroom/miniconda/base/bin/yt-dlp --cookies-from-browser chrome \ --proxy "http://127.0.0.1:$PROXY" \ --write-auto-sub --sub-lang "zh-CN,zh-Hans,zh-Hant" --convert-subs srt --skip-download \ -o "%(id)s.%(ext)s" "URL" ``` ```bash /opt/homebrew/Caskroom/miniconda/base/bin/yt-dlp --cookies-from-browser chrome \ --proxy "http://127.0.0.1:$PROXY" \ -x --audio-format mp3 --audio-quality 0 -o "%(id)s.%(ext)s" "URL" ``` ### Technical Analysis The documented normal workflow instructs `yt-dlp` to read cookies from the user's Chrome profile for subtitle discovery, subtitle download, and audio download. Public YouTube content generally does not require an authenticated browser session, so making browser-cookie extraction the default exceeds the least privilege needed for the primary task. The audit found no project code that intentionally sends cookies to an unrelated service. Nevertheless, cookie access places authenticated YouTube session material within the trust boundary of `yt-dlp`, its dependencies, and any enabled components. A compromised component or malicious local replacement could capture that material. ### Attack Path 1. The user follows one of the documented default commands. 2. `yt-dlp` accesses Chrome's cookie database and extracts cookies usable for YouTube requests. 3. A compromised `yt-dlp` installation, dependency, plugin, or executable replacement captures the extracted session material. 4. The attacker obtains or exports the captured cookies. 5. Where ...[truncated 689 chars]

Remediation

View remediation

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:199

Finding

Runtime Retrieval of a Mutable Remote JavaScript Component

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is narrowly focused on batch transcribing already-existing local MP3 files using faster-whisper. It does support batch processing, which matches part of the description, but it does not interact with YouTube, does not retrieve or prioritize subtitles, does not implement a fallback pipeline, and does not produce structured notes or extracted content beyond plain transcript text. Therefore, the declared description materially overstates and misrepresents the implemented behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The implemented script is narrowly focused on retrieving existing YouTube transcripts/subtitles for one video at a time and formatting them as text or JSON. While this partially aligns with the '字幕优先' portion of the description, it does not implement the other prominently declared behaviors: there is no Whisper fallback when subtitles are unavailable, no batch handling of multiple videos, and no generation of structured notes or higher-level content extraction beyond concatenated transcript text. This is a material description-behavior mismatch in primary advertised capabilities.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 78% confidence

Finding

The YARA hit is triggered by repeated browser-cookie extraction patterns, which in many environments overlap with credential-harvesting techniques. In this skill, the surrounding context appears functional rather than overtly malicious, but the capability is still dangerous because it reads sensitive browser session data and can be repurposed to access authenticated content or expose credentials indirectly.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

��频 → Whisper 转录 → 生成笔记

text

**永远先检查字幕可用性**——字幕是即时的（无需下载），比 Whisper 更准确（尤其是中文自动字幕），每视频节省 ~20min。

## 快速开始

### 依赖

```bash
pip install youtube-transcript-api faster-whisper

单视频处理

bash

# 1. 检查字幕
/opt/homebrew/Caskroom/miniconda/base/bin/yt-dlp --cookies-from-browser chrome \
  --proxy "http://127.0.0.1:$PROXY" --list-subs "URL" 2>&1 | grep -E "(has |zh-CN|zh-Hans)"

# 2a. 有字幕 → 直接下载
/opt/homebrew/Caskroom/miniconda/base/bin/yt-dlp --cookies-from-browser chrome \
  --proxy "http://127.0.0.1:$PROXY" \
  --write-auto-sub --sub-lang "zh-CN,zh-Hans,zh-Hant" --convert-subs srt --skip-download \
  -o "%(id)s.%(ext)s" "URL"

# 2b. 无字幕 → 下载音频 + Whisper
# 下载音频
/opt/homebrew/Caskroom/miniconda/base/bin/yt-dlp --cookies-from-browser chrome \
  --proxy "http://127.0.0.1:$PROXY" \
  -x --audio-format mp3 --au

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 93% confidence

Finding

The document explicitly instructs use of --cookies-from-browser chrome to extract browser cookies for authenticated YouTube access. In an agent skill context, guidance that accesses browser-stored authentication material is dangerous because it normalizes credential/token harvesting behavior and could enable unauthorized account use or leakage of sensitive session data beyond the stated purpose.

Content

Scanner excerpt · references/whisper-transcription.md (reported line 147)May include surrounding context.

�� yt-dlp 命令解析到旧的 Homebrew 版本。始终用 conda 版本：

bash

/opt/homebrew/Caskroom/miniconda/base/bin/python3 -m yt_dlp ...  # 最安全
/opt/homebrew/Caskroom/miniconda/base/bin/yt-dlp ...             # 也可

YouTube 反爬："Sign in to confirm you're not a bot"

两种子问题：

1. 无 cookies（公开视频被当 bot） 修复：conda yt-dlp + --cookies-from-browser chrome + --remote-components ejs:github

2. 视频需要登录（LOGIN_REQUIRED） 无 cookies 绕过方案。--cookies-from-browser chrome 是唯一可靠方法。

Chrome cookie 解密可能静默失败（返回 0 cookies）。验证 Chrome 已登录 YouTube。

Members-only 内容

text

ERROR: [youtube] VIDEO_ID: Join this channel to get access to members-only content

无法绕过，立即告知用户需要频道会员。

不要尝试的方案

方案	问题
手动解密 Chrome v10 cookies	`security find-generic-passwor

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill clearly instructs network access and writing output files, but the manifest does not declare any corresponding tool scope or allowed-tools boundary. That creates a least-privilege and review gap: an operator may approve the skill based on incomplete metadata while it still performs external fetches and local file creation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented use of --cookies-from-browser chrome pulls browser authentication material into the workflow, expanding the skill from content extraction into access to local credential-bearing data. Even if intended to access gated YouTube content, this is dangerous because browser cookies may grant session access far beyond the immediate task and can expose sensitive account context if mishandled or logged.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs the agent to access Chrome cookies without clearly warning the user that this touches credential and privacy-sensitive browser data. In an agent context, silently normalizing browser-cookie extraction is especially risky because it can lead to unintended authenticated requests, leakage in logs, or use of a user's session to access private or subscription-only resources.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The example transcription command hard-codes language='zh', and other sections instruct generation of structured Chinese notes by default. This is a language/locale constraint presented as default behavior without clearly offering user choice or opt-in, which can violate organizational language policy requirements.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The template explicitly instructs the sub-agent to produce 结构化中文笔记 and repeats that requirement in the context. This enforces a specific output language without documenting opt-in or offering an alternative based on user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The rule '使用视频内容相同的语言' forces output language to match the video language as a blanket requirement. This is a natural-language locale policy constraint with no user opt-in or alternative, which can violate organizational expectations to let users choose language when feasible.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill's stated purpose is YouTube transcription and structured note extraction. The documented step networksetup -getwebproxy Wi‑Fi reads host network configuration to discover a proxy port, which is an environment-inspection capability outside the core content-extraction mission and not declared in the manifest description.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reference begins with Chinese-only prose and continues in Chinese throughout the document, which effectively forces a specific language for users reading the skill reference. The policy allows locale constraints only when they are justified or optional, but this file does not provide an opt-in choice or explain that the document is intentionally limited to Chinese readers.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.