Security audit
Security checks for vulnerabilities and agentic risk
This transcript skill does its core job, but its setup instructions give the agent too much control over account creation, OTP handling, and long-term API key storage.
Review this before installing. The transcript API use is expected, but setup should ideally be done by the user through the provider's site and a secure secret store, not by pasting API keys or OTP codes into chat or letting the agent decide how to persist credentials indefinitely.
The instructions explicitly tell the agent to determine how to persist TRANSCRIPT_API_KEY across all future sessions and shells before any user-specific need is established. Persisting third-party API credentials long-term on the local system is sensitive secret-handling behavior and is not justified by the narrow transcript-extraction purpose described in the skill metadata.
The skill instructs the agent to ask the user to paste an API key directly into chat and then set it up, which solicits a secret in plain language and encourages the model context to become a credential collection channel. Chat transcripts, logs, debugging systems, or downstream tooling may retain that secret, creating unnecessary exposure.
The signup flow has the agent create external accounts on the user’s behalf, submit their email to a third party, receive an OTP, and complete verification to obtain an API key. This exceeds the stated transcript-processing scope and delegates identity and account actions to the agent, which increases privacy, consent, and account-takeover risk.
The signup flow tells the agent to collect a 6-digit email OTP from the user and use it to complete account verification and retrieve an API key. OTPs are authentication factors, so routing them through the agent turns the model into an intermediary for account access and increases the risk of interception, retention, or misuse.
The document instructs the agent to persistently store the obtained API key for future sessions and non-interactive shells, extending exposure far beyond the immediate task. Long-lived secret persistence by a task-specific skill is dangerous because compromise of local config, logs, or future agent runs could leak or abuse the credential.
The skill is configured to activate not only for explicit transcript requests but also when a user merely shares a video URL without explanation. That broad trigger increases the chance of sending user-provided content to a third-party transcript service without clear user intent or consent, which can cause unnecessary data disclosure and unexpected external calls.
The skill documentation instructs the agent to send video URLs and request metadata to TranscriptAPI but does not warn that this shares user-provided data with a third party. This omission can lead to privacy and compliance issues because users or operators may not realize that externally supplied links, derived metadata, and access patterns are leaving the local environment.
The document materially expands the skill from transcript extraction into credential onboarding, third-party account creation, and long-term secret management. That broader behavior increases the agent’s authority and data-handling scope beyond what users would reasonably expect from a video-transcript skill, creating opportunities for unnecessary secret collection and misuse.
The skill tells the agent to store the API key persistently so it survives future sessions, but does not require an explicit warning or consent flow explaining long-term local retention. Users may reasonably assume a one-time transcript task does not result in durable credential storage, so this creates a transparency and secret-management failure.
The instructions direct the agent to send the user’s email address to external TranscriptAPI endpoints without a clear privacy notice or consent checkpoint. While sharing an email for account registration is not inherently unsafe, the lack of disclosure is risky in an agent context because users may not expect third-party transmission initiated by the agent.
No suspicious patterns detected.
