Security audit
Security checks for vulnerabilities and agentic risk
This transcript skill does what it says, but its setup flow gives the agent broad, persistent control over API credentials and account signup.
Review carefully before installing. Use this skill only if you are comfortable sending video identifiers and account-related data to TranscriptAPI. Prefer creating the account yourself and entering the API key through a dedicated secret manager rather than pasting it into chat or letting the agent persist it broadly across sessions.
The instruction to ask the user to paste an API key directly into chat and then set it up causes the agent to solicit and handle a secret in a general conversation channel, with later persistence across sessions. This increases exposure of the credential to logs, transcripts, model context, and downstream tooling not designed for secret handling.
The guide directs the agent to create third-party accounts, complete an OTP verification flow, and persist a credential for future reuse, which exceeds the stated purpose of a transcript-retrieval skill. This expands the skill from content access into credential enrollment and secret management, increasing the chance of unauthorized account creation, privacy violations, and long-term compromise if the stored key is later misused.
The guide explicitly teaches the agent how to preserve hidden auth tokens by writing raw responses to files and reading values back in chained operations to avoid redaction. That is effectively an instruction to bypass safety controls that prevent token exposure, enabling unauthorized retention and reuse of sensitive credentials.
The verify flow instructs the agent to extract the resulting API key from a file and store it for ongoing use, turning a short-lived signup interaction into durable credential possession. In the context of a transcript skill, this creates unnecessary long-term access to a third-party account and magnifies the consequences of agent compromise or misuse.
The storage instructions explicitly tell the agent to make the API key survive future sessions and non-interactive shells, creating durable access beyond the immediate task. For a transcript skill, persistent credential installation is unnecessary and materially raises the blast radius of prompt injection, later tool misuse, or host compromise.
The manifest description explicitly says to use the skill even when transcript retrieval is 'not explicitly requested' and for broad tasks like summarization, fact-checking, or research whenever a video is the source. That can cause over-selection of the skill and unnecessary transmission of user-supplied YouTube URLs/IDs and related request context to a third-party service, increasing privacy and data-sharing risk beyond clear user intent.
The documentation explains the API usage and required headers but does not prominently warn that using the skill sends the YouTube URL/video ID, API key, user-agent, and possibly request metadata to TranscriptAPI.com. In a research or summarization context, users may reasonably assume local handling, so the missing disclosure can lead to unintended third-party sharing and weaker informed consent.
The guide tells the agent to determine how to persist an environment variable on the machine before any user warning or consent about long-lived secret storage. Storing API keys across sessions without clearly disclosing the security implications can cause users to unknowingly leave reusable credentials on disk or in shared environments.
The skill instructs the agent to register an account using the user's email with a third-party service, but does not require clear notice about data sharing, account creation, or downstream privacy consequences. This is risky because the agent is transmitting personally identifiable information and initiating an external relationship on the user's behalf.
No suspicious patterns detected.
