Youtube Summarizer

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:48 AM UTC
• Version: 0.1.1

Overview

This skill does what it says: it fetches YouTube transcripts and guides the agent to summarize them, with normal but real dependency and network-use caveats.

Install in a normal least-privilege environment and consider pinning or reviewing youtube-transcript-api and yt-dlp before use. Expect the skill to make outbound requests to YouTube-related services and to default summaries to Chinese unless you specify another language.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–20 and line 119
Vulnerability Type: Unpinned and integrity-unverified third-party dependencies
Risk Level: Medium

Vulnerable Code

bash

pip3 install youtube-transcript-api -q
# yt-dlp is needed for video metadata (title, channel, duration)
# Install if not present: brew install yt-dlp  OR  pip3 install yt-dlp

The error-handling documentation repeats the unpinned installation instruction:

markdown

| `youtube-transcript-api not installed` | Run `pip3 install youtube-transcript-api` |

Technical Analysis

The skill instructs users or agents to install youtube-transcript-api and yt-dlp without specifying reviewed versions or verifying package integrity through cryptographic hashes. Consequently, each installation resolves mutable package versions from the configured package registry.

Python package installation can execute package-controlled build and installation logic. If an upstream release, maintainer account, package registry, or dependency in the transitive dependency chain is compromised, following these instructions could execute attacker-controlled code under the identity of the user running pip3.

No evidence indicates that the named packages are currently malicious. The vulnerability is the absence of version pinning and integrity controls, which leaves execution dependent on externally mutable artifacts that were not part of this audit.

Attack Path

1. An attacker compromises a dependency maintainer account, distribution channel, or a transitive dependency.
2. The attacker publishes a malicious or backdoored package release under a dependency name used by the skill.
3. A user or agent follows the documented pip3 install command.
4. The package manager resolves and downloads the compromised release because no version or hash is constrained.
5. Malicious build, installation, import-time, or runtime code executes with the privileges of the accoun ...[truncated 677 chars]

Remediation

View remediation

Remediation Suggestions

1. Create a reviewed dependency file containing exact versions, for example:

text

youtube-transcript-api==REVIEWED_VERSION
yt-dlp==REVIEWED_VERSION

2. Generate and record cryptographic hashes for every direct and transitive dependency, then require hash verification:

bash

python3 -m pip install --require-hashes -r requirements.txt

3. Commit a lock file generated from a controlled dependency-resolution process so installations are reproducible.
4. Use an explicitly trusted package index and prevent fallback to untrusted or user-controlled registries.
5. Perform dependency vulnerability and provenance checks before updating locked versions.
6. Review package updates in a controlled environment and update pins and hashes only after validation.
7. Avoid automatically installing packages during normal skill execution. Treat dependency installation as a separate, explicit setup operation performed with least privilege.
8. Update the error-handling instructions at line 119 to reference the locked, hash-verified installation process rather than an unconstrained pip3 install command.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code accurately supports transcript retrieval from multiple YouTube URL formats and outputs structured transcript data, which matches part of the description. However, the declared primary purpose also includes generating structured summaries with key viewpoints, notable quotes, and topic analysis. None of those analytical or summarization capabilities are implemented in this code chunk. Therefore, the description overstates the skill's actual behavior in a material way.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence

Finding

The skill uses 'network' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file contains a natural-language locale policy that forces a specific default language without user opt-in. The rules explicitly state that when the user does not specify a language, output must be Chinese for all content, which is a language-policy constraint rather than a user choice.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.