ytdlp-transcript — YouTube to Text via yt-dlp

• Outcome: Review
• Latest audit: Sep 12, 2026 · 2:54 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward YouTube caption fetcher with some dependency hygiene issues, but no evidence of hidden, destructive, persistent, or credential-stealing behavior.

Before installing, regenerate the lockfile from package.json, remove unused dependencies, and keep yt-dlp updated. Expect the skill to contact YouTube for the supplied video and to return raw transcript text for the agent to summarize or translate.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Note

• Location: package-lock.json:7

Finding

Dependency Lockfile Contains Undeclared and Unused Dependency Trees

Content

View full analysis

Vulnerability Details

File Location: package-lock.json, lines 7-18; inconsistent with package.json, lines 11-13
Vulnerability Type: Supply-chain exposure caused by inconsistent dependency manifests
Risk Level: Low

The root entry in package-lock.json declares four direct dependencies:

json

"": {
  "name": "youtube-transcript",
  "version": "1.0.0",
  "license": "ISC",
  "dependencies": {
    "@distube/ytdl-core": "^4.16.12",
    "xml2js": "^0.6.2",
    "youtube-transcript": "^1.3.0",
    "youtubei.js": "^16.0.1"
  }
},

However, package.json declares only one dependency:

json

"dependencies": {
  "xml2js": "^0.6.2"
},

The executable in transcript.js uses only Node.js built-in modules and does not import any of the packages listed above. The three additional direct dependency trees in the lockfile—@distube/ytdl-core, youtube-transcript, and youtubei.js—are therefore undeclared and unused by the reviewed implementation.

Technical Analysis

A lockfile is part of the trusted software supply chain. Retaining dependencies that are absent from the authoritative package manifest obscures the intended dependency set and can cause environment-dependent installation behavior. Package managers or automated tooling that directly honors or analyzes the stale lockfile may retrieve substantially more third-party code than the application requires.

In particular, @distube/ytdl-core introduces several transitive networking, proxy, cookie, parser, and HTTP client packages. This unnecessarily expands the number of external maintainers and packages that must remain uncompromised. Although no package in the supplied lockfile was confirmed to be malicious, the inconsistency creates avoidable supply-chain exposure and makes dependency review less reliable.

The lockfile also records packages such as @distube/ytdl-core and undici that require Node.js 20.18.1 or later, whi ...[truncated 1560 chars]

Remediation

View remediation

Remediation Suggestions

1. Delete package-lock.json and regenerate it from the authoritative package.json using a clean, trusted npm environment:

   bash

   rm -rf node_modules package-lock.json
   npm install
   

2. Verify that the regenerated root dependency entry contains only dependencies intentionally required by the application.
3. Remove xml2js as well if it is not planned for use, because the current transcript.js implementation does not import it.
4. Commit package.json and package-lock.json together and require lockfile consistency checks in CI, such as a clean npm ci validation.
5. Run dependency auditing and provenance checks after regeneration, and review any package that introduces lifecycle scripts.
6. Align the declared Node.js engine with the actual dependency graph and test the minimum supported Node.js version in CI.
7. Consider automated dependency review that rejects unexplained additions to the root lockfile dependency set.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The implementation is narrowly a transcript fetcher/cleaner for YouTube subtitles. It uses yt-dlp to retrieve auto-subtitles, reads VTT files from temporary storage, strips timestamps/markup, deduplicates lines, and prints transcript text. There is no logic for summarization, translation, analysis, or insight extraction. The declared description therefore materially overstates the skill's capabilities and slightly overstates coverage by implying it works for any YouTube video, जबकि the code fails when no transcript is available.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==7.24.4 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The lockfile pins undici to 7.24.4, and the provided advisory set indicates known HIGH-severity vulnerabilities affecting HTTP connection handling and response parsing. Because this skill fetches remote YouTube content and transcripts over the network, a vulnerable HTTP client increases risk of response desynchronization, cross-request data exposure, denial of service, or incorrect response handling if a malicious or intermediary endpoint can influence traffic.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The text states that the skill "Supports all languages — defaults to Portuguese (pt), falls back to English (en)." This imposes a specific language/locale behavior without indicating user choice or opt-in, which is a natural-language policy violation under the locale policy rule.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code defaults the transcript language to 'pt' in both getTranscript() and main(), which imposes a specific locale unless the user explicitly overrides it. This is a natural-language policy concern because the skill silently prefers one language rather than offering a neutral default or prompting for user choice.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The markdown explains that the skill uses yt-dlp to download captions from YouTube, but it does not explicitly warn users that providing a URL causes a network request to an external service and retrieval of remote content. For a markdown skill description, this is a privacy/system-behavior disclosure that should be stated clearly.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The dependency uses a caret range (^0.6.2), which permits automatic installation of newer compatible releases instead of a single fixed version. This increases supply-chain risk because future installs may resolve to a different package version than was originally tested, potentially introducing malicious or vulnerable code without changes to this repository.

Content

Scanner excerpt · package.json (reported line 13)May include surrounding context.

json

"author": "Datis",
  "license": "MIT",
  "dependencies": {
    "xml2js": "^0.6.2"
  },
  "engines": {
    "node": ">=18.0.0"

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: transcript.js:61