Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly aligned with YouTube channel browsing, but its setup asks agents to handle and persist API credentials in broad, under-disclosed ways.
Review this skill before installing. It sends YouTube channel identifiers and searches to TranscriptAPI and requires a TranscriptAPI key. Prefer creating the account yourself, entering the key through a secure secret mechanism, and avoiding broad shell-profile or agent-config persistence unless you are comfortable with that key being reused in future sessions.
This document introduces TranscriptAPI credential collection, account creation, and secret persistence inside a skill whose stated purpose is YouTube channel exploration. That is a clear scope mismatch that could cause the agent to solicit and store unrelated third-party credentials, expanding the attack surface and enabling unauthorized data handling.
The instruction to ask users to paste an API key and then set it up for future use explicitly solicits and persists a secret credential. In this skill context, that is especially dangerous because the capability is unrelated to YouTube channel browsing and creates unnecessary long-term access to a third-party service.
The skill instructs the agent to create third-party accounts, receive user email addresses, trigger OTP delivery, and complete verification on the user's behalf. For a YouTube browsing skill, this is unjustified and dangerous because it normalizes identity and account operations unrelated to the advertised functionality.
The flow tells the agent to capture a temporary access token from a raw response file and reuse it in a follow-up request. This is secret retention and transfer logic that increases the risk of credential leakage, replay, or mishandling, particularly because it is engineered to bypass output redaction mechanisms.
The verification step instructs the agent to extract the returned API key from a file and retain it for later storage, again deliberately avoiding normal redaction behavior. That creates a durable secret-handling pipeline inside an unrelated skill and increases the chance of exfiltration, misuse, or persistence beyond user expectations.
The instructions require persistent storage of an API key across future sessions and non-interactive shells, even though this is outside the stated YouTube-channel-focused purpose. Persisting a sensitive secret beyond the immediate task increases exposure, especially if written into shell profiles or agent-managed config without strict controls.
The guide tells the agent to determine how to persist an environment variable system-wide and then collect/store a user's API key, but it does not warn the user that sensitive credentials may be written to disk or shared across future sessions. This undermines informed consent and increases the chance of accidental disclosure through files, backups, or other processes.
The guide explicitly instructs writing raw authentication responses containing access tokens to temporary files, and later doing the same with API keys, without addressing file permissions, lifecycle, or local exposure risks. Sensitive credentials on disk can be recovered from temp directories, logs, crash reports, backups, or by other local processes.
The skill requires sending channel identifiers, search queries, and related browsing inputs to TranscriptAPI, but the setup text does not clearly disclose that user-provided queries are transmitted to a third-party service. This creates a privacy and data-handling transparency issue, especially when users may enter sensitive search terms or internal research targets.
The manifest description limits the skill to channel-focused tasks such as browsing uploads, searching within a channel, and resolving handles. In the 'Typical workflow' section, the skill explicitly instructs using a transcript endpoint for a recent video, which adds a video-transcript retrieval capability not described as part of this skill's scope.
The flow directs the agent to collect the user's email and send it to a third-party registration endpoint without clear upfront privacy disclosure in the skill's purpose or setup. While lower severity than secret persistence, it still creates privacy and consent concerns because personal data is transmitted to an unrelated external service.
No suspicious patterns detected.
