Security audit

captions

Security checks for vulnerabilities and agentic risk

Overview

The skill fetches YouTube captions as advertised, but it also asks the agent to create and persist a third-party API credential broadly, so users should review it before installing.

Install only if you are comfortable giving TranscriptAPI the YouTube URLs or IDs you use with the skill and letting your agent handle a TranscriptAPI API key. Prefer creating the account and storing the key yourself in a scoped secret manager rather than allowing broad persistent shell or agent-environment storage.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The file explicitly directs the agent to determine how to persistently store TRANSCRIPT_API_KEY for all future sessions, including non-interactive shells. For a caption-fetching skill, persistent secret installation is excessive and dangerous because it can expose credentials to unrelated tasks, broaden the blast radius of compromise, and normalize long-lived secret retention in agent-accessible environments.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill's documented behavior goes beyond fetching captions and instructs the agent to create third-party accounts, handle OTP-based verification, and obtain/store API credentials on the user's behalf. That expands the trust boundary from content retrieval into account provisioning and secret management, creating unnecessary opportunities for credential mishandling, user confusion, and abuse inconsistent with the skill's stated purpose.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation description is unusually broad: it triggers not only when users explicitly ask for captions, but also for pasted links, content review, translation, language learning, and even cases where captions are only implicitly useful. That can cause the agent to invoke the skill on ordinary requests and send video identifiers to a third-party service without a clear, specific user intent to do so, increasing privacy and overreach risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs the agent to send YouTube URLs or video IDs, along with request metadata such as User-Agent and authorization headers, to TranscriptAPI.com, but it does not clearly warn users about this network disclosure in the skill description. In contexts involving private, unlisted, sensitive, or user-provided links, this can leak user intent and content references to a third party without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The storage instructions tell the agent to persist the API key so it survives across sessions and shells, but they do not require informed user consent or explain the security/privacy implications of long-term credential storage. This is especially risky in an agent context where secrets may become accessible to future runs, other tools, or broader execution environments beyond the immediate caption task.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.