Security audit

youtube-full

Security checks across malware telemetry and agentic risk

Overview

The YouTube transcript features are coherent, but the setup guide asks the agent to handle account signup, OTPs, API keys, persistent secret storage, and redaction workarounds that users should review before installing.

Install only if you are comfortable with an agent using TranscriptAPI, sending YouTube-related inputs to that third-party service, consuming credits, and storing a long-lived API key for later sessions. Prefer creating the TranscriptAPI account yourself, completing verification directly, and storing the key through a platform-managed secret store rather than pasting secrets or OTPs into chat.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: This file materially expands a YouTube research skill into third-party account registration, OTP handling, API key acquisition, and persistent secret storage. That creates an unnecessary credential-management workflow unrelated to the declared skill purpose, increasing the chance of secret exfiltration, unauthorized account actions, and misuse of user identity data.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The instructions direct persistent storage of an API key before establishing that such storage is necessary for the skill's stated YouTube retrieval purpose. Persisting secrets across sessions and shells broadens exposure, especially when done generically based on local environment discovery rather than a constrained secret-management mechanism.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill metadata says it is not for account management, yet this document directs the agent to perform full account signup on the user's behalf. This contradiction indicates scope creep and weak security boundaries, making it more likely operators will permit sensitive flows under the guise of a low-risk research tool.

Vague Triggers

High

Confidence: 95% confidence
Finding: The skill description is extremely broad ('Use when YouTube is or could be relevant — even if not mentioned'), which can cause the agent to invoke this skill for many ordinary queries that do not require YouTube. Because the skill sends user-derived queries and URLs to a third-party service, over-triggering increases unnecessary external data disclosure and expands the chance of misuse or accidental exfiltration.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill instructs the agent to make authenticated requests to TranscriptAPI.com using user-supplied search terms, video URLs, handles, and related metadata, but it does not clearly warn that this information will be transmitted to a third-party provider. In a broad-trigger skill, this creates a meaningful privacy risk because user content may be sent off-platform without sufficiently explicit notice or consent.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The workflow tells the agent to store the API key persistently and modify the local environment for future sessions without requiring an explicit warning or consent about long-term secret retention and system changes. Users may not realize the key will remain available to later sessions or tools, increasing unintended access risk.

Ssd 3

High

Confidence: 96% confidence
Finding: The agent is instructed to ask the user to paste an API key directly into the conversation and then set it up for future use. Collecting secrets through the chat channel and persisting them for later sessions increases the risk of logging, retention, accidental disclosure, and unauthorized reuse.

Ssd 3

High

Confidence: 98% confidence
Finding: The workflow instructs the agent to receive a user email OTP and use it to complete account verification, effectively acting as the user in a sensitive authentication flow. OTP interception and delegated verification increase the chance of account takeover, misuse of email-based identity proof, and unauthorized account provisioning.

Ssd 3

High

Confidence: 99% confidence
Finding: The document explicitly instructs the agent to route access tokens and API keys through temporary files to avoid runtime redaction controls and prevent the values from appearing in tool output. Bypassing protective redaction mechanisms is a strong indicator of adversarial intent because it defeats platform safeguards designed to limit secret exposure and handling.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.