Security audit

youtube-data

Security checks for vulnerabilities and agentic risk

Overview

The skill's YouTube data functions are coherent, but its setup flow asks the agent to handle API keys, account signup, email OTPs, and persistent credential storage in a way users should review carefully.

Install only if you are comfortable with an agent using TranscriptAPI, sending your email to that service for signup if needed, receiving a verification code, and storing an API key for reuse. Prefer creating the account yourself and providing the key through a scoped secret manager rather than pasting secrets or OTPs into chat.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file is centered on TranscriptAPI authentication, signup, OTP verification, HTTP auth flows, and secret persistence rather than the YouTube-data retrieval promised by the skill metadata. This mismatch is dangerous because off-scope instructions are a common indicator of prompt/skill repurposing that can trick the agent into handling credentials and privileged actions the user did not expect.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The guide directs the agent to determine how to persistently store TRANSCRIPT_API_KEY across sessions and shells, which is a credential-management function outside the declared scope of a YouTube data retrieval skill. Persistent secret storage broadens compromise impact because a mishandled key remains available to future sessions, tools, or unrelated tasks.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly asks the user to paste an API key and then instructs the agent to store it so it survives future sessions. Soliciting secrets directly in chat and persisting them across sessions creates a high-risk path for accidental disclosure, logging exposure, and reuse by unrelated workflows.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The document instructs the agent to create and verify third-party TranscriptAPI accounts, including handling registration tokens and OTPs on the user's behalf. That capability is unrelated to the skill's stated YouTube-data purpose and expands the agent into account provisioning and authentication handling, which materially increases the risk of credential misuse, phishing-like behavior, and unauthorized account access workflows.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow tells the agent to ask the user for a 6-digit email verification code and use it to complete account verification on the user's behalf. OTPs are authentication factors, so collecting and replaying them through the agent effectively places the agent in the middle of an account login/verification flow and increases the risk of account takeover, consent confusion, and sensitive-code retention in logs.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger description is unusually broad because it activates not only on explicit YouTube URLs or transcript requests, but also on general 'topic research' and requests where YouTube is 'not mentioned explicitly.' That can cause the agent to invoke this internet-connected skill for ordinary research tasks, expanding data exposure and increasing the chance of unnecessary external requests, quota use, or retrieval of untrusted content without clear user intent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instructions tell the agent to send user email to a third-party service, collect OTPs, and persist an API key, but they do not clearly disclose the privacy implications, retention behavior, or system-level effects of storing credentials on disk. Users may unknowingly authorize sensitive account operations and local secret persistence without informed consent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.