YouTube Watcher

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:48 PM UTC
• Version: 1.0.0

Overview

This skill is a simple YouTube transcript helper with some quality and supply-chain caveats, but no artifact-backed malicious or deceptive behavior.

Install only if you are comfortable relying on yt-dlp from your configured Homebrew or pip sources, and expect the skill may need repair because the referenced transcript script is not included in the inspected package. Treat non-YouTube video requests carefully because the triggers are broader than the stated purpose.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 12
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

yaml

metadata: {"clawdbot":{"emoji":"📺","requires":{"bins":["yt-dlp"]},"install":[{"id":"brew","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (brew)"},{"id":"pip","kind":"pip","package":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (pip)"}]}}

Technical Analysis

The installation metadata permits yt-dlp to be installed from a third-party package registry without specifying an audited version or an integrity hash. Consequently, the installed artifact can change after this Skill has been reviewed.

This does not demonstrate that the legitimate yt-dlp package is malicious. The risk arises because installation security depends on the future state of the package registry, publisher account, configured package source, and dependency resolution process. If any of those supply-chain components are compromised or redirected, an attacker-controlled package release could be installed.

The Homebrew installation alternative is also unversioned, although its distribution and verification controls differ from those of Python package installation.

Attack Path

1. An attacker compromises a relevant package publisher or distribution account, package source, or dependency delivery channel.
2. The attacker publishes or serves a malicious release under the expected yt-dlp package identity.
3. A user or agent installs the Skill dependency through the declared unpinned installation method.
4. The resolver selects the attacker-controlled release because no approved version or artifact hash is enforced.
5. Malicious package installation behavior or subsequently invoked package code executes with the privileges of the installing or invoking user.

This exploitation path is conditional on compromise or manipulation of the upstrea ...[truncated 725 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to a specifically reviewed version rather than resolving the latest available release.
2. For Python installations, distribute a requirements or lock file containing cryptographic hashes and install with hash verification, such as pip install --require-hashes.
3. Configure an explicitly trusted package index and disable unintended fallback indexes to reduce dependency-confusion and source-redirection risks.
4. For Homebrew installations, document the trusted tap and use an approved versioned formula or verified package artifact where feasible.
5. Regularly review pinned dependency versions for security advisories and update them through a controlled review process.
6. Install and execute the dependency as an unprivileged user in a restricted environment with only the filesystem and network access required for transcript retrieval.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrases include very generic terms such as "summarize video" and "analyze video", which can match many ordinary requests that are not clearly limited to YouTube transcript retrieval. This can cause the skill to activate in unintended contexts, leading the agent to invoke external tooling or fetch remote content when another safer or more appropriate capability should have handled the request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.