Security audit
Security checks for vulnerabilities and agentic risk
The skill fetches YouTube subtitles through TranscriptAPI, but its setup instructions give the agent broad credential-collection, account-signup, token-handling, and persistent secret-storage authority that users should review carefully.
Review this before installing if you are comfortable letting an agent handle TranscriptAPI credentials. Prefer creating the account and API key yourself, then store the key only through a trusted secret manager or scoped environment mechanism. Avoid pasting sensitive keys or OTPs into chat unless you understand the storage and exposure implications.
The skill explicitly instructs the agent to ask the user to paste an API key and then set it up for ongoing use. Collecting raw credentials in conversational flow is dangerous because it normalizes credential disclosure to the model and bypasses safer platform secret-entry mechanisms.
The skill is described as fetching YouTube subtitles, but this file instructs the agent to create third-party accounts, collect user credentials, and persist API secrets across sessions. That is a material expansion of capability and trust boundary, increasing the chance of credential mishandling, unauthorized account actions, and covert secret collection unrelated to the user-facing purpose.
The guide directs the agent to perform full signup and OTP verification on the user's behalf, including handling verification tokens and exchanging them for an API key. This gives the skill identity-binding and credential-issuance capabilities that exceed subtitle access and create phishing-like and account takeover risks if the flow is abused or redirected.
Saving raw authentication responses containing access tokens to temporary files creates a local secret-at-rest exposure and increases the number of places where credentials may leak through logs, file permissions, crash artifacts, or reuse of temp paths. The text is especially concerning because it is designed to evade output redaction controls by moving secrets through files instead of safer credential channels.
The same temp-file token capture pattern is repeated for the final API key, followed by instructions to preserve it for later storage. This compounds the secret-handling risk and appears tailored to circumvent runtime redaction, making accidental or intentional credential exfiltration more likely.
The file instructs the agent to store the recovered API key persistently so it is available in future sessions and non-interactive shells. That creates durable credential exposure far beyond the immediate subtitle task, enabling unintended reuse by other tools, future prompts, or compromised environments.
The skill sends user-supplied YouTube video URLs or IDs, and potentially related metadata, to TranscriptAPI.com, but the user-facing description does not clearly warn that a third-party service receives this data. This can create a privacy and transparency issue, especially when users may assume the processing is local or first-party and may share sensitive or unlisted video links.
The document emphasizes persistent environment setup before any subtitle task is performed, pushing the agent to establish long-lived credential-management behavior not justified by the manifest. This broadens the blast radius of any compromise because the key is intentionally made available across future sessions and shells.
The instructions tell the agent to solicit and persist an API key without requiring a clear warning that the credential will be stored for future sessions and may be exposed to other tools or contexts. Users are therefore not given meaningful notice or consent about the privacy and security consequences of long-term secret storage.
No suspicious patterns detected.
