ClawHub
Back to skill

Security audit

Gemini Yt Video Transcript

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: it uses Google Gemini to create a YouTube transcript and saves the result locally.

Install only if you are comfortable using your Gemini API key and sending the YouTube URL/video reference to Google Gemini. The skill writes transcript files locally in the workspace output folder by default, and custom output paths are constrained to workspace or temporary directories.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill's declared purpose emphasizes transcript-only behavior, but the implementation also writes files, fetches external metadata, generates filename stems via Gemini, and prepends a title header. This mismatch can mislead users and reviewers about what data leaves the system and what artifacts are created, increasing the chance of unintended disclosure, unnecessary external requests, or unsafe automation assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill declares executable capabilities requiring environment access, network access, and file writes, but does not explicitly scope or constrain those tools in the manifest. This weakens reviewability and enforcement, making it easier for the skill to overreach or for operators to miss that it can access secrets, contact external services, and persist data locally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script sends user-supplied YouTube content and related prompts to Google's Gemini API, which is an external third party, without any explicit user-facing notice, consent step, or privacy warning in the tool flow. In this skill context, users may assume the tool is only fetching a transcript for a public video, but the implementation forwards the URL and requests model processing of the video content, creating a data-sharing and privacy risk, especially for private/unlisted or sensitive URLs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.