YouTube字幕提取-免费版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.0.1

Overview

The skill mostly describes a YouTube subtitle extractor, but it has mismatched SEO triggers and loosely scoped network/exec behavior that should be reviewed before installation.

Review this skill before installing. Use it only for explicit YouTube subtitle tasks, avoid providing callback URLs unless you trust the destination, install yt-dlp in an isolated environment from a trusted source, and do not provide browser cookies unless you intentionally need access to a private video.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:219

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 219-222, 306-308, and 368
Vulnerability Type: Supply-chain risk caused by unpinned package installation
Risk Level: Medium

Vulnerable Code

bash

# Lines 219-222
pip3 install yt-dlp
# ...
# Or install with brew (macOS)
brew install yt-dlp

bash

# Lines 306-308
pip3 install yt-dlp
# Or
brew install yt-dlp

bash

# Line 368
pip3 install yt-dlp

Technical Analysis

The Skill directs the Agent to install yt-dlp without pinning an exact, reviewed version and without verifying a package hash or signature. Consequently, the installed artifact is determined by mutable package-registry or package-manager state at execution time rather than by the reviewed Skill package.

This is a supply-chain weakness: compromise of the upstream package, maintainer account, package registry, configured mirror, package-manager repository, or a transitive dependency could cause malicious code to be installed. Python packages may execute build or installation logic, and installed command-line programs execute code when invoked. The Skill also declares the exec tool, making automated execution of the installation instructions plausible.

The audit did not establish that the legitimate yt-dlp package is malicious. The vulnerability is the absence of dependency pinning and integrity controls.

Attack Path

1. An attacker compromises the upstream package, a maintainer account, a configured registry or mirror, or relevant dependency distribution infrastructure.
2. The compromised source publishes or serves a malicious package version or dependency.
3. A user asks the Agent to use the Skill on a system where yt-dlp is unavailable.
4. Following SKILL.md, the Agent executes pip3 install yt-dlp or brew install yt-dlp.
5. The package manager resolves the mutable dependency and installs attacker-controlled content.
6. Malic ...[truncated 737 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to an exact version that has been reviewed and tested, rather than installing the latest available release.
2. For pip, require package hashes through a locked requirements file, for example with pip install --require-hashes -r requirements.txt.
3. Store the exact version and expected cryptographic hashes in the Skill package and update them only through a controlled review process.
4. Use a trusted, explicitly configured package index or internally controlled artifact repository.
5. Install the dependency in an isolated virtual environment or container under a non-privileged account.
6. Avoid sudo, administrator execution, and system-wide package installation.
7. Apply equivalent version-locking and repository-trust controls if Homebrew remains a supported installation method.
8. Add a preflight check that reports a missing dependency instead of automatically installing software without explicit user approval.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Vague Triggers

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The trigger conditions are both incorrect and overly broad, instructing use for SEO and ranking-related tasks that are unrelated to subtitle extraction. In an agentic environment, broad mismatched triggers can route arbitrary requests into a skill with exec and network capabilities, creating a prompt-to-action pathway for unintended external requests, file writes, or shell commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The input format allows a user-supplied callback_url and the workflow requires external network access, but the documentation does not warn that user data or task results may be sent to external destinations. Without clear warnings and restrictions, this can enable SSRF-style behavior, unintended data exfiltration, or privacy violations if the agent posts results to arbitrary URLs.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The trigger condition says the skill should be used for SEO optimization, keyword analysis, ranking improvement, and search traffic optimization, which conflicts with the documented purpose of YouTube subtitle extraction. This mismatch can cause the agent to invoke the skill in unrelated contexts and operate on unintended user inputs, increasing the chance of unsafe command execution or network activity outside the user's intent.

Content

No source excerpt is available for this finding.