Security audit

Kai YouTube

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it needs review because unvalidated URL text is used in local file paths that are deleted and rewritten.

Review before installing. Use only trusted YouTube URLs, expect outbound network requests and retained audio/transcript files, and prefer a patched version that validates exact YouTube hosts and 11-character video IDs before deleting or writing files.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/youtube.sh:18
Finding: Unsanitized YouTube Video ID Allows Filesystem Path Traversal
Content: View full analysis
Remediation: View remediation
&2 exit 1 fi ``` 4. Construct the destination path only after validation and verify its canonical parent remains beneath the canonical workspace directory. 5. Reject identifiers containing `/`, `\`, `..`, control characters, or newline characters even if validation logic changes later. 6. Prevent symbolic-link attacks by ensuring the workspace has restrictive ownership and permissions, refusing symlinked path components, and using safely created files where practical. 7. Use `--` before positional path arguments for utilities that support it, for example: ```bash rm -f -- "$AUDIO_OUTPUT" "$TRANSCRIPT_OUTPUT" cat -- "$TRANSCRIPT_OUTPUT" ``` 8. Consider obtaining the canonical video ID from `yt-dlp` metadata and independently validating it before using it as a filename. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger phrases are very generic terms such as "youtube," "transcribe this," and "watch this video," which are likely to appear in normal conversation and can cause unintended invocation of the skill. Because this skill downloads remote content and writes files into the workspace, accidental activation has real side effects including network access, storage use, and processing of untrusted external media.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill description explains functionality but does not prominently warn users that it downloads audio from external URLs and persists audio and transcript files in a workspace directory. This reduces informed consent and increases the chance that users trigger the skill without understanding the privacy, storage, and provenance implications of pulling untrusted remote content into the local environment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script retrieves remote content from YouTube, stores it locally, deletes prior local files with matching names, and sends the downloaded audio into a transcription tool without any explicit consent prompt or warning about network access, storage, or overwrite behavior. In an agent/skill context, that can surprise users, leak intent through outbound requests, and cause unintended local data loss or accumulation, even though the behavior appears aligned with the tool's stated purpose rather than malicious.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.