YouTube Analysis

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:14 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-aligned for YouTube analysis, but it under-specifies safe handling of user-supplied URLs in a command execution path.

Review before installing. The skill appears intended to analyze YouTube videos, not to hide behavior, but it should be updated to require validated HTTPS YouTube URLs and shell-free argument passing before agents execute the transcript command.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:18

Finding

Potential Command Injection Through User-Controlled YouTube URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–22
Vulnerability Type: Shell command injection
Risk Level: Medium

Vulnerable code:

bash

summarize "URL" --youtube web --video-mode transcript --extract --format md

text

When invoking it via `exec`, give it a long timeout and generous `yieldMs` so slow extraction is not killed early.

Technical Analysis

The skill instructs the agent to place a user-provided YouTube URL into a command that may be invoked through exec. It does not require URL validation, shell-free argument passing, or escaping appropriate to the execution environment.

If an implementation replaces the URL placeholder through direct string interpolation and passes the resulting command to a shell, surrounding the value with double quotes is not a complete defense. An attacker may supply embedded quotation marks, command substitutions, or shell metacharacters that terminate or alter the intended argument. The shell could then interpret attacker-controlled content as additional commands.

Exploitability depends on the agent's exec implementation. An argument-array API that bypasses the shell would prevent shell metacharacter interpretation, while textual command construction followed by shell execution would expose the vulnerability.

Attack Path

1. An attacker submits a crafted value presented as a YouTube URL.
2. The agent follows the skill instructions and substitutes that value into the documented summarize "URL" ... command.
3. The agent invokes the constructed command through a shell-backed exec interface.
4. The crafted value escapes or modifies the quoted argument using shell syntax.
5. The shell executes attacker-supplied commands with the privileges of the agent process.

Impact Assessment

Successful exploitation could allow arbitrary command execution under the operating-system account running the agent. The attacker could pote ...[truncated 491 chars]

Remediation

View remediation

Remediation Suggestions

• Invoke summarize using a process API that accepts an executable and a separate argument array, without enabling a shell. For example, pass the URL as one argument rather than interpolating it into a command string.
• Parse and normalize the supplied URL before execution.
• Permit only the https scheme and explicitly approved YouTube hostnames, accounting for normalized hostname boundaries rather than substring matching.
• Reject credentials in URLs, control characters, malformed encoding, unexpected quotation marks, and inputs that are not valid URLs.
• Document that agents must not use shell interpolation for the URL, even when it appears inside quotation marks.
• Apply least privilege to the execution environment, including restricted filesystem access, limited environment variables, network controls, and execution time and output limits.
• Add tests using malicious inputs containing embedded quotes, semicolons, command substitutions, newlines, and other shell metacharacters to verify that every value remains a single inert process argument.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README says the skill activates automatically whenever a user provides a YouTube URL, but it does not define scope limits, exclusions, or negative examples. This is ambiguous because users may paste a YouTube link for reasons other than wanting transcript analysis, creating risk of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.