Security audit

YouTube字幕提取-免费版

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a YouTube subtitle helper, but its trigger guidance, privacy claims, callback option, and cookie handling are under-scoped enough that users should review it before installing.

Install only if you are comfortable with an agent running yt-dlp commands, accessing YouTube, and possibly writing transcript files locally. Avoid using private-video cookies or callback_url unless you fully trust the endpoint and understand what transcript data may be sent. The publisher should narrow the trigger to YouTube subtitle tasks and clarify privacy behavior before routine use.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The documentation contains contradictory guidance: it explicitly says the skill is not suitable for SEO-related tasks, but the trigger condition tells agents to invoke it for SEO optimization, keyword analysis, and ranking work. This can cause the agent to misroute unrelated requests into a tool with `exec`, `write`, and networked subtitle-fetching behavior, increasing the chance of inappropriate execution and user confusion.

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The skill claims to be a 'pure local run' and says content is 'not uploaded', yet it also documents network access to YouTube and dependence on an LLM API. These conflicting privacy statements can mislead users into sharing sensitive URLs, cookies, or transcript content under false assumptions about data locality and disclosure.

Vague Triggers

High

Confidence: 97% confidence
Finding: The trigger condition is unrelated to the skill's stated YouTube subtitle function and is overly broad, covering SEO optimization and ranking scenarios. In agent environments, broad or mismatched triggers can cause the wrong tool to auto-activate, leading to unintended command execution, network access, or file creation in contexts the user did not request.

Missing User Warnings

Medium

Confidence: 83% confidence
Finding: The documentation instructs writing extracted subtitles to local paths such as `/tmp/transcript.txt` without warning about file creation, overwrites, residual sensitive content, or multi-user visibility. In shared or automated environments, this can leak transcript data or clobber existing files unexpectedly.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The optional `callback_url` allows processed results or metadata to be sent over the network, but the documentation provides no privacy or trust warning. This creates a risk of silent exfiltration of transcript content, video identifiers, or user queries to arbitrary destinations if the parameter is used carelessly or maliciously.

Static analysis

No suspicious patterns detected.