Security audit

YouTube 提文案

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says: extracts YouTube transcripts through RedFox, optionally translates them to Chinese, and saves/export files, with some privacy and credential-handling caveats.

Install only if you are comfortable sending the video URL and transcript workflow to RedFox, and non-Chinese transcript text to Google Translate unless you use --no-translate. Prefer REDFOX_API_KEY as a scoped environment variable, avoid passing keys on the command line, protect any config file with owner-only permissions, and use --no-save or a private output directory for sensitive transcripts.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:157
Finding: Unpinned Third-Party Runtime Dependencies
Content: View full analysis
Remediation: View remediation
openpyxl== deep-translator== ``` 2. Generate and verify cryptographic hashes for every direct and transitive dependency, then install with: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Use a lock-generation tool to produce deterministic transitive dependency versions. 4. Recommend installation inside a dedicated virtual environment rather than the user's global Python environment. 5. Periodically scan the lock file for known vulnerabilities and review dependency updates before changing pinned versions. 6. Prefer prebuilt artifacts from trusted package indexes and document the expected index explicitly. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:129
Finding: API Credential Exposure Through Command-Line Arguments and Plaintext Configuration
Content: View full analysis
~/.qoder/apis/redfox.json` | ``` Credential-loading implementation: ```python # API key management (CLI > environment variable > configuration file) def get_api_key(cli_key=None): if cli_key: return cli_key env_key = os.environ.get(ENV_KEY) if env_key: return env_key if CONFIG_FILE.exists(): try: data = json.loads(CONFIG_FILE.read_text()) key = data.get("api_key") if key: return key except (json.JSONDecodeError, OSError): pass return None ``` Command-line credential parameter: ```python parser.add_argument("--api-key", default=None, help="Specify RedFox API Key") ``` The loaded credential is transmitted to the declared RedFox HTTPS endpoint as an authentication header: ```python headers = {"REDFOX_API_KEY": api_key, "Content-Type": "application/json"} ``` ### Technical Analysis Passing the API key through `--api-key` places the secret in the process argument vector. It may also place the key in shell history, command logging, terminal-session recordings, diagnostic output, or process-monitoring systems. Process-argument visibility depends on the operating system and its security configuration, but secrets should not be placed in command-line arguments. The documented configuration-file command writes the credential as plaintext and does not set restrictive permissions ...[truncated 1879 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Automatic translation via Google Translate implies transcript text may be transmitted to a third-party service, but the documentation does not clearly disclose this data flow or obtain user consent. Transcript content may contain confidential, copyrighted, or regulated material, so silent third-party transmission creates a meaningful privacy and compliance risk.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The overview states that non-Chinese subtitles are automatically translated into Chinese by default. This imposes a specific language/locale behavior without explicit user opt-in, which is a natural-language policy issue unless clearly optional or justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The feature description says the skill prefers Chinese subtitle tracks and automatically translates non-Chinese subtitles into Chinese. Although an opt-out flag exists, the natural-language policy requires user choice or opt-in rather than forcing a locale-specific default.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README says users can 'Simply describe what you need in natural language,' which is an overly broad invocation description for a markdown skill file. It does not define specific trigger phrases, scope limits, or exclusion conditions, increasing the chance of unintended activation from ordinary requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill description states that non-Chinese subtitles are automatically translated into Chinese by default, rather than requiring an explicit user opt-in. Automatic translation can alter meaning, expose content to an additional external translation service, and override the user's expected data handling or output language preferences. In this skill's context, that risk is increased because transcript text may contain sensitive or copyrighted material and the workflow silently adds a second processing step.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README tells users to invoke the skill with broad natural-language phrases such as asking to extract a video's transcript, export Excel, or summarize content. In an agent environment, triggers this generic can overlap with ordinary conversation and cause unintended skill activation, potentially sending user-provided URLs or content to external services without clear intent. The skill context makes this somewhat more dangerous because it interacts with third-party services and may process arbitrary links and transcript content.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill invokes a local Python script, reads API keys from environment/config, performs network requests, and writes Markdown/Excel files, yet it declares no explicit tool scope or permissions. That can cause the agent to exercise filesystem, network, and secret-access capabilities without clear sandboxing or user-visible consent boundaries.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description states that non-Chinese subtitles are automatically translated into Chinese and that results are presented in Chinese. This is a language-policy concern because the skill imposes a specific locale by default rather than initially offering a user choice or opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill states that transcript results are automatically archived to ~/Downloads and can be exported to Excel, but it does not prominently warn that local files are written by default. This can expose sensitive transcript content on disk unexpectedly, especially on shared machines or managed environments with backup/sync enabled.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The workflow mandates that the transcript content column show the full Chinese translation and notes that non-Chinese subtitles are automatically translated unless the user explicitly asks otherwise. This enforces a specific language output without prior opt-in, which is a natural-language locale policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The defaults and surrounding text indicate a Chinese-first language policy: DEFAULT_LANGUAGE = "zh,en,asr", and non-Chinese transcripts are automatically translated to Chinese unless the user disables it. This imposes a specific language/locale behavior without first offering a neutral choice or explicit opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script automatically sends transcript text to GoogleTranslator when the detected subtitle language is not Chinese, and this behavior is enabled by default. Transcript content may contain sensitive or copyrighted material, so silently transmitting it to a third-party translation service creates a real privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The core feature posts the user-supplied YouTube URL, language preferences, and optional metadata request to redfox.hk, an external service, without an explicit privacy notice or confirmation. While this is necessary for the feature to function, users may not realize their input and associated video information are being transmitted off-host to a third party.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.