YouTube Transcript with Speaker Diarization

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:19 AM UTC
• Version: 1.0.2

Overview

The skill is a legitimate YouTube transcript integration, but its script has review-worthy weaknesses that could expose the API key or allow command execution through crafted arguments.

Review before installing. Use only the default diarize endpoint unless you fully trust a custom endpoint, keep API keys out of untrusted OpenClaw config or inherited environments, and avoid letting an agent or external input choose timeout or polling arguments until the script validates them as bounded positive integers.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/youtube-transcript.sh:53

Finding

API Credential Transmission to an Unrestricted Configurable Endpoint

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/youtube-transcript.sh:125

Finding

Command Execution Through Unvalidated Bash Arithmetic Input

Content

View full analysis

&2 printf "%s\n" "$create_response" >&2 exit 1 fi if [[ "$status" == "COMPLETED" ]]; then fetch_transcript "$job_id" "$format" "$api_key" "$base_url" return fi started_at="$(date +%s)" while true; do now="$(date +%s)" if (( now - started_at >= timeout_seconds )); then echo "Timed out waiting for job ${job_id}. Check it later with:" >&2 echo " $(basename "$0") status ${job_id}" >&2 exit 2 fi ``` ```bash run) if [[ $# -lt 1 ]]; then print_usage exit 1 fi local format local timeout_seconds local poll_interval_seconds format="$(require_format "${2:-$DEFAULT_FORMAT}")" timeout_seconds="${3:-$DEFAULT_TIMEOUT_SECONDS}" poll_interval_seconds="${4:-$DEFAULT_POLL_INTERVAL_SECONDS}" run_job "$1" "$format" "$timeout_seconds" "$poll_interval_seconds" "$api_key" "$base_url" ;; ``` ### Technical Analysis The optional timeout argument is copied directly from command-line input into `timeout_seconds` and later evaluated inside Bash arithmetic syntax: ```bash (( now - started_at >= timeout_seconds )) ``` Bash arithmetic evaluation does not treat variable contents solely as decimal data. Va ...[truncated 2036 chars]

Remediation

View remediation

&2 exit 1 fi if (( 10#$value > maximum )); then echo "$name must not exceed $maximum." >&2 exit 1 fi } timeout_seconds="${3:-$DEFAULT_TIMEOUT_SECONDS}" poll_interval_seconds="${4:-$DEFAULT_POLL_INTERVAL_SECONDS}" require_positive_integer "timeout-seconds" "$timeout_seconds" 3600 require_positive_integer "poll-interval-seconds" "$poll_interval_seconds" 300 ``` Additional hardening should include: 1. Reject zero, negative, signed, whitespace-containing, and expression-like values. 2. Use explicit base-10 conversion only after regex validation. 3. Enforce reasonable upper bounds to prevent unexpectedly long execution. 4. Ensure the polling interval cannot be zero or so small that it causes abusive API polling. 5. Treat Agent-generated CLI arguments as untrusted input even when the script is normally called through documented examples. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill exposes shell-based execution via a referenced script but does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent or runtime may invoke shell capabilities more broadly than intended, reducing policy enforcement and making misuse or unsafe command execution harder to constrain.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-transcript.sh (reported line 80)May include surrounding context.

sh

local base_url="$5"

  if [[ -n "$body" ]]; then
    curl -fsS -X "$method" \
      -H "Authorization: Bearer $api_key" \
      -H "Content-Type: application/json" \
      "${base_url}${path}" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This shell script submits a user-supplied YouTube URL to an external service and later retrieves job and transcript data via HTTP requests, but it provides no confirmation prompt, no user-facing notice about the remote transmission, and no explanatory comments/docstrings describing that behavior. Because these requests send user data off-system to diarize.io or a configured endpoint, the lack of disclosure matches the missing-warning criterion for code files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.