YouTube Watcher

• Outcome: Pass
• Latest audit: May 28, 2026 at 10:02 AM UTC
• Version:
  1.0.0

Overview

This skill is a simple YouTube transcript helper with a minor trigger-scoping caveat and an apparent missing helper script, but no evidence of malicious behavior.

Use this only for YouTube transcript tasks and be aware that its generic triggers may activate for broader video requests. Also verify any get_transcript.py helper separately if you obtain one elsewhere, because that script is referenced but not included in this package.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrases include generic terms like "summarize video" and "analyze video," which can match many unrelated user requests and cause the skill to activate unexpectedly. In this skill's context, unintended invocation could expose the agent to external YouTube URLs and transcript-fetching behavior when the user did not specifically request this tool, increasing the chance of unnecessary external access or incorrect tool selection.

VirusTotal

64/64 vendors flagged this skill as clean.