Youtube Video Analyzer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 7:25 PM UTC
• Version: 1.0.0

Overview

This skill does what it says: it downloads and analyzes YouTube video content locally, with some normal privacy and dependency cautions but no hidden or destructive behavior found.

Install only if you are comfortable with the agent downloading YouTube content to temporary local files and installing yt-dlp from the package index. Avoid using browser cookies for private or restricted videos unless you explicitly approve it and understand that local session access may be involved.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20-25
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: Medium

Vulnerable Code

yaml

install:
  - kind: uv
    package: yt-dlp
    bins: [yt-dlp]

Technical Analysis

The skill directs the runtime to install yt-dlp without specifying a reviewed version, lock file, cryptographic hash, or signature verification policy. Consequently, the package selected during installation may change over time without any corresponding change to the reviewed skill.

Although no malicious dependency is present in the audited project, this configuration creates a supply-chain trust boundary. If the upstream package, package repository, maintainer account, or dependency-resolution process is compromised, an attacker-controlled release could be installed. The resulting executable is subsequently invoked to process attacker-influenced YouTube URLs and remote content.

Attack Path

1. An attacker compromises the upstream package publication channel, repository account, or another component involved in dependency resolution.
2. The attacker publishes a malicious or compromised version that satisfies the unrestricted yt-dlp package specification.
3. The skill installation process resolves and installs that version because no version or integrity constraint is defined.
4. The agent later invokes the installed yt-dlp executable during metadata, subtitle, or video processing.
5. Malicious dependency code executes with the privileges and environmental access of the agent process.

This path depends on compromise or manipulation of the external dependency supply chain; the audited file does not itself contain an embedded malicious payload.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the operating-system account running the skill. The attainable scope may include:

• R ...[truncated 561 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to a specific version that has been reviewed and tested, rather than resolving the latest available release.
2. Enforce cryptographic hash verification through a locked dependency manifest or equivalent integrity-controlled installation process.
3. Restrict package resolution to an explicitly configured, trusted package index and require TLS certificate validation.
4. Review and update the pinned version through a controlled dependency-update process that includes vulnerability scanning and behavioral testing.
5. Install and execute the dependency in a sandbox or dedicated least-privilege environment with restricted filesystem, credential, and network access.
6. Avoid exposing unrelated secrets or browser data to the process. If browser cookies are required for an authorized private video, obtain explicit user consent and use a dedicated, minimally privileged browser profile.
7. Record the resolved package version and integrity information so deployments can be reproduced and audited.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger condition is broad enough that the skill may activate on nearly any YouTube URL when the user expresses a general desire to 'analyze' or 'understand' it. Over-broad activation can cause unintended execution, unnecessary network access, and processing of external content the user may not have intended to hand to this specific skill, which increases privacy and prompt-routing risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill instructs the agent to download the full video, transcript, and extracted frames into a temporary local directory, but it does not warn the user beforehand that copies of potentially sensitive content will be written to disk. Even if cleanup is attempted later, failures, crashes, or logs can leave residual data behind, creating privacy and data-retention risks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.