ClawHub
Back to skill

Security audit

YouTube Summary - Auto Video Summarizer

Security checks for vulnerabilities and agentic risk

Overview

This skill fetches public YouTube captions and helps an AI summarize them, with some dependency and prompt-injection cautions but no hidden persistence, credential access, or destructive behavior.

Before installing, consider pinning the dependency version and adding explicit instructions that captions are untrusted source text to summarize, not commands to follow. Use it for public videos only and avoid exposing unrelated secrets, tools, or conversation history during summarization.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
requirements.txt:1
Finding

Unbounded Third-Party Dependency Allows Unreviewed Package Releases

Content
View full analysis

Vulnerability Details

File Location: requirements.txt:1 and SKILL.md:78-82
Vulnerability Type: Supply-chain risk caused by an unbounded dependency
Risk Level: Medium

Vulnerable Code

requirements.txt:1:

text
youtube-transcript-api>=0.6.0

SKILL.md:78-82:

markdown
**Requirements:**

pip install youtube-transcript-api

text

Technical Analysis

The dependency specification accepts every version of youtube-transcript-api from version 0.6.0 onward. The installation instructions similarly install the latest available version without a lock file, exact version constraint, or integrity hash.

Consequently, the code reviewed during this audit is not necessarily the code that will execute in a future installation. Package installation and import both involve execution of third-party code. If a later release is compromised, malicious, or unexpectedly incompatible, users following these instructions may install and execute it automatically.

This finding does not establish that the current package is malicious. It identifies a supply-chain control weakness that permits unaudited future releases.

Attack Path

  1. An attacker compromises the upstream package maintainer account, package repository, or release pipeline.
  2. The attacker publishes a malicious version newer than 0.6.0.
  3. A user installs the project dependencies using pip install -r requirements.txt or follows the command in SKILL.md.
  4. The package resolver selects the malicious newer release because it satisfies the lower-bound-only constraint.
  5. Attacker-controlled code executes during package installation or when youtube_transcript_api is imported and used.

Impact Assessment

Successful exploitation could provide code execution with the privileges of the user or service installing or running the Skill. The resulting scope could include files, environment variables, network credentials, a ...[truncated 138 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin youtube-transcript-api to a specific version that has been reviewed and tested.
  2. Generate a lock file containing all transitive dependency versions.
  3. Require verified package hashes, such as through pip install --require-hashes.
  4. Review dependency updates before changing the pinned version.
  5. Add automated dependency vulnerability and provenance scanning to the release process.
  6. Keep the documentation consistent with the locked installation process rather than recommending an unconstrained pip install.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/summarize.py:41
Finding

Untrusted YouTube Captions Are Forwarded to an AI Model Without Instruction Isolation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:38 and scripts/summarize.py:41-50
Vulnerability Type: Indirect prompt-injection exposure through attacker-controlled transcript content
Risk Level: Medium

Vulnerable Code

SKILL.md:38:

markdown
3. **Generate summary** with the AI model using the subtitle text

scripts/summarize.py:41-50:

python
output.append("")
output.append("Full Transcript:")
output.append("---")

for i, chunk in enumerate(chunks):
    if len(chunks) > 1:
        output.append(f"\n[Part {i+1}/{len(chunks)}]\n")
    output.append(chunk)

output.append("\n---")

Technical Analysis

YouTube captions are externally controlled content. A video publisher can place instruction-like text in manually authored captions, while generated captions may reproduce spoken instruction-like content. The formatter inserts that content into a model-facing document under a generic Full Transcript heading, but it does not state that the transcript is untrusted data or that commands found inside it must never be followed.

Delimiters alone do not establish a security boundary for a language model. If the formatted transcript is placed into an AI prompt, embedded text such as requests to ignore the summarization task, reveal context, change output, or use available tools may be interpreted as instructions rather than source material.

The Python formatter does not itself invoke an AI model or provide tool access. Exploitability and maximum impact therefore depend on how a consuming Agent constructs its prompt and what tools, credentials, memory, and data that Agent can access.

Attack Path

  1. An attacker publishes a public YouTube video with captions containing adversarial model instructions.
  2. A user asks the Skill to summarize that video.
  3. youtube_subtitles.py retrieves the attacker-controlled captions.
  4. summarize.py places the caption text into the ...[truncated 997 chars]
Remediation
View remediation

Remediation Suggestions

  1. Add a higher-priority model instruction that identifies the transcript as untrusted source data and prohibits following any instructions contained within it.
  2. Pass the transcript in a dedicated structured data field rather than concatenating it with operational instructions.
  3. Use explicit boundaries and state that those boundaries contain quoted content only; do not rely on delimiters as the sole defense.
  4. Disable tool use while summarizing whenever possible. If tools are necessary, require explicit user confirmation for consequential actions.
  5. Do not expose secrets, hidden prompts, unrelated conversation history, or persistent memory to the summarization step.
  6. Validate the model output against the requested summary format and reject outputs that attempt to issue commands, request secrets, or redirect the workflow.
  7. Add regression tests using captions that contain prompt-injection phrases to verify that they are summarized as content rather than obeyed.

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (5)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description promises a functional YouTube subtitle retrieval and summarization tool. However, the actual code chunk does not implement any of those behaviors. It is a stub/example script whose only effect is printing a simple message. This is a material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description promises an end-to-end YouTube summarization capability: retrieving subtitles from YouTube and producing concise summaries with configurable length and multilingual support. The actual code only reads text from a local file, removes whitespace artifacts, chunks the text, and formats it for downstream summarization. This is a helper/preprocessing script, not a subtitle fetcher or summarizer. While formatting transcripts for summarization is related, the primary declared capabilities are not implemented in this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The code accurately supports part of the description: retrieving YouTube subtitles in different languages. However, the key advertised capability of generating concise summaries is absent. There is no summarization logic, no length control for summaries, and no extraction of key points or main ideas beyond returning raw transcript text. The script also exposes a language-listing feature not mentioned in the description, though that is secondary. Because the declared primary purpose includes summarization and the actual code only fetches subtitles, this is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency is specified with a lower-bound range (>=0.6.0) rather than being pinned to an exact version, which makes builds non-reproducible and can unexpectedly pull in newer releases with security regressions, breaking changes, or even a compromised upstream package version. In this skill, the package is used to fetch external content from YouTube, so supply-chain trust matters; while this is not immediately exploitable on its own, it increases exposure to dependency-related risk over time.

Content

Scanner excerpt · requirements.txt (reported line 1)May include surrounding context.

text
youtube-transcript-api>=0.6.0

Static analysis

No suspicious patterns detected.