YouTube Download to Cloud Storage — FlashData

• Outcome: Pass
• Latest audit: Oct 16, 2026 · 4:48 AM UTC
• Version: 1.0.0

Overview

This skill clearly describes a paid FlashData workflow for downloading YouTube media into user-controlled cloud storage, with sensitive credential handling disclosed and bounded by user approval guidance.

Install only if you are comfortable giving FlashData a scoped API key and narrowly scoped, preferably temporary, write-only storage credentials for the destination bucket or container. Confirm cost and rights before submitting a job, and avoid pasting secrets or signed URLs into chat or logs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 101)May include surrounding context.

md

For hosted MCP, connect `https://data.flashdata.dev/mcp` using Streamable HTTP and an `X-API-Key` header in your client's protected settings. Keep keys out of chat and committed files.

Storage credentials are transmitted to FlashData to perform the upload; MCP clients may retain tool arguments in their history. Use narrowly scoped credentials, and do not print credentials or signed access tokens in the returned file summary.

If a submission times out, do not resubmit automatically; it may already have been charged. Use `get_job` if an ID was returned. Without an ID, report the outcome as unknown and check Jobs in the FlashData console; `get_job` cannot look up a job without its ID. A failed or pending job is not a completed upload. For a chunked MCP response, use `get_result` with the returned `result_id` and `next_offset` as `offset`, then join the text chunks before parsing. The CLI returns complete JSON.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The skill explicitly instructs users to send API credentials and storage destination credentials to external FlashData endpoints, including transmission of the user's private storage configuration so the service can upload media on the user's behalf. This creates a real confidentiality and trust-boundary risk: compromise, misuse, logging retention, or MCP client history exposure could leak cloud credentials or sensitive storage metadata.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

## Connection and errors

For hosted MCP, connect `https://data.flashdata.dev/mcp` using Streamable HTTP and an `X-API-Key` header in your client's protected settings. Keep keys out of chat and committed files.

Storage credentials are transmitted to FlashData to perform the upload; MCP clients may retain tool arguments in their history. Use narrowly scoped credentials, and do not print credentials or signed access tokens in the returned file summary.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The schema restricts audio_language to only default or original, which imposes a fixed locale/language behavior without offering broader user language choice or documenting a justified regional constraint. Under the policy, forced language or locale behavior without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This manifest-style JSON defines S3 storage using generic placeholder values like "your-media-bucket" and lacks any constraints or negative examples clarifying what storage targets are valid or prohibited. That ambiguity can lead to accidental use of the skill against arbitrary buckets or environments without clear scoping.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.