Youtube Watcher

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.0

Overview

This skill coherently fetches YouTube transcripts for summarization, with disclosed use of yt-dlp, but users should treat fetched captions as untrusted text and be aware of the unpinned external dependency.

Install only if you are comfortable running yt-dlp from your package manager. Use it for intended YouTube transcript tasks, avoid treating transcript text as instructions, and review unusual video content carefully before allowing any follow-on tool actions suggested by the transcript.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10
• Finding: Unpinned Third-Party Executable Dependency## Vulnerability Details **File Location**: `SKILL.md:10` **Vulnerability Type**: Unpinned and unverified third-party dependency **Risk Level**: Medium ### Vulnerable Code ```yaml metadata: {"clawdbot":{"emoji":"📺","requires":{"bins":["yt-dlp"]},"install":[{"id":"brew","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (brew)"},{"id":"pip","kind":"pip","package":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (pip)"}]}} ``` ### Technical Analysis The Skill declares installation of `yt-dlp` through Homebrew or pip without specifying an audited version or requiring package integrity verification. Consequently, the code that is installed and executed can change after the Skill itself has been reviewed. This creates a supply-chain exposure: if the upstream package, its distribution account, package repository, or a transitive dependency is compromised, installation may introduce malicious code. The script subsequently invokes the resolved `yt-dlp` executable by name, so any compromised package implementation would execute during normal transcript retrieval. ### Attack Path 1. An attacker compromises an upstream `yt-dlp` release, its package publication process, or an applicable transitive dependency. 2. A user installs the dependency using the unpinned Homebrew or pip declaration. 3. The package manager resolves and installs the compromised version. 4. Malicious installation code may execute immediately, or malicious runtime code is installed as the `yt-dlp` executable. 5. When `scripts/get_transcript.py` invokes `yt-dlp`, the attacker-controlled code executes with the privileges of the user running the Skill. ### Impact Assessment Successful exploitation could permit arbitrary code execution under the installing or running user's account. The resulting scope could include access to that user's files, environment variables, network connectivity, and any credentials available to the process. Thi ...[truncated 189 chars]
• Remediation: ## Remediation Suggestions - Pin `yt-dlp` to a specifically reviewed version rather than accepting the latest available release. - For pip-based installation, use a locked requirements file with cryptographic hashes and enforce installation with `--require-hashes`. - Use only trusted official package repositories and prevent fallback to untrusted indexes or mirrors. - Where supported, verify package signatures or distribution checksums before installation. - Review new dependency versions before updating the pin and document a controlled update process. - Run dependency installation and transcript processing inside a restricted environment with minimal filesystem, credential, and network access.

other

Warning

• Location: scripts/get_transcript.py:62
• Finding: Untrusted Video Subtitles Can Indirectly Inject Agent Instructions## Vulnerability Details **File Location**: `scripts/get_transcript.py:62-64`; consuming instructions in `SKILL.md:29-30` **Vulnerability Type**: Indirect prompt injection through attacker-controlled transcript content **Risk Level**: Medium ### Vulnerable Code `scripts/get_transcript.py:62-64`: ```python content = vtt_file.read_text(encoding='utf-8') clean_text = clean_vtt(content) print(clean_text) ``` `SKILL.md:29-30`: ```markdown 1. Get the transcript: ```bash python3 {baseDir}/scripts/get_transcript.py "https://www.youtube.com/watch?v=dQw4w9WgXcQ" ``` 2. Read the output and summarize it for the user. ``` ### Technical Analysis YouTube subtitles are externally controlled content. A video owner or another party able to modify captions can place natural-language instructions inside the subtitle track. The script removes VTT timestamps and HTML-like tags, but it does not mark, delimit, or otherwise distinguish transcript data from trusted Agent instructions. The Skill then directs the Agent to read and summarize the output. If the consuming Agent does not maintain a strict trust boundary, malicious text such as instructions to ignore the user's request, disclose contextual information, or invoke available tools may be interpreted as operational instructions rather than as quoted video content. The issue is not shell command injection: `subprocess.run` receives an argument list and does not enable a shell. It is an indirect prompt-injection risk at the point where untrusted transcript text is presented to the Agent. ### Attack Path 1. An attacker publishes a YouTube video with crafted English subtitles or compromises the captions of an existing video. 2. The subtitle text includes instructions designed to manipulate an AI Agent. 3. A user asks the Skill to summarize or analyze the attacker-controlled video. 4. `yt-dlp` retrieves the captions, and the script prints the cleaned text without ...[truncated 813 chars]
• Remediation: ## Remediation Suggestions - Amend `SKILL.md` to state explicitly that transcript output is untrusted data and that instructions contained within it must never be followed. - Place transcript content inside clear structural delimiters and tell the Agent to use it only as source material for the user's requested analysis. - Separate trusted control instructions from fetched content using the Agent framework's dedicated data or tool-output channel where available. - Require user confirmation before any tool invocation or sensitive action suggested by transcript content. - Apply least privilege to the consuming Agent and prevent transcript-derived content from authorizing filesystem, credential, network, or state-changing operations. - Consider scanning retrieved text for common prompt-injection patterns as a supplementary measure, while not relying on pattern matching as the primary defense.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill invokes a local Python script and requires a shell-accessible binary (`yt-dlp`), but it does not declare any explicit tool scope such as `permissions` or `allowed-tools`. This creates an avoidable trust gap: an agent may grant broader shell or file-read capability than necessary, increasing the blast radius if the script or its inputs are abused.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger phrases include generic requests like `summarize video` and `analyze video`, which can match many unrelated user intents beyond YouTube transcripts. Overbroad triggers can cause the wrong skill to activate, leading to unnecessary shell execution or retrieval attempts against attacker-supplied URLs when a safer or more appropriate skill should handle the request.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

]
        
        try:
            subprocess.run(cmd, cwd=temp_dir, check=True, capture_output=True)
        except subprocess.CalledProcessError as e:
            print(f"Error running yt-dlp: {e.stderr.decode()}", file=sys.stderr)
            sys.exit(1)

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: The command hard-codes `--sub-lang en`, which enforces English regardless of user preference or source language. This is a natural-language/locale policy concern because the skill does not provide any opt-in or configurable language selection.

Static analysis

No suspicious patterns detected.