Youtube Video Analyzer

• Outcome: Pass
• Latest audit: May 28, 2026, 11:24 AM
• Version:
  1.0.0

Overview

This skill does what it claims: it analyzes YouTube videos by downloading transcript/video data locally and extracting frames, with no evidence of hidden scripts, exfiltration, or persistence.

Install only if you are comfortable with the agent downloading YouTube media/subtitles into a temporary local directory and processing frames. Avoid using --cookies-from-browser unless you deliberately want the tool to use your browser login state for a specific video, and clean up temporary files after analysis.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger language is broad enough to activate on generic requests about summaries, tutorials, or shared YouTube links, which can cause the skill to run when the user did not clearly intend network retrieval and multimodal processing. In this skill's context, unintended invocation is more dangerous because execution leads to external downloads, local temporary file creation, and potentially expensive processing rather than a harmless text-only transformation.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: These instructions direct the agent to fetch remote content, create a temporary working directory, download transcripts, and store media locally without any user-facing notice or consent boundary. That creates privacy and transparency risks because users may not realize their request causes outbound network access, local persistence of potentially sensitive content, and use of external tools.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Advising use of `--cookies-from-browser` for age-restricted or private videos introduces sensitive credential material into the workflow without any safety guidance. In context, this is especially risky because browser cookies may grant account-level access and can expose private subscriptions, session tokens, or restricted content if mishandled, logged, or reused beyond the user's intent.

VirusTotal

66/66 vendors flagged this skill as clean.