Security audit

youtube-playlist

Security checks across malware telemetry and agentic risk

Overview

The playlist feature is legitimate, but the setup flow asks the agent to handle account signup, OTPs, raw tokens, and persistent API-key storage in ways users should review carefully.

Install only if you are comfortable using TranscriptAPI and letting the skill send YouTube playlist/video targets to that service. Prefer creating the TranscriptAPI account yourself, entering the API key through a secure secret manager, and avoiding shell-profile or long-term environment storage unless you know how to remove or revoke the key later.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The document instructs the agent to create third-party TranscriptAPI accounts, collect user email and OTPs, and persistently store API credentials, which is outside the stated YouTube-playlist skill scope. This creates unnecessary credential-handling and account-management behavior, expanding the attack surface and enabling unauthorized secret collection or persistence under the guise of playlist functionality.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The instructions tell the agent to determine how to persist environment variables on the host and make the secret available across future sessions and non-interactive shells. For a playlist-oriented skill, this is unjustified privilege expansion and can lead to long-lived credential exposure, misuse across unrelated tasks, or leakage through shell/config files.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The skill routes user-supplied playlist identifiers and follow-on transcript requests to TranscriptAPI.com, but the user-facing description does not clearly warn that this is an external third-party network service. That can create a privacy and consent issue because users may not realize their playlist/video targets and research activity are being transmitted off-platform.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The guide mandates persistent storage of an API key and temporary handling of authentication artifacts without warning about the risks of credential retention, shell/profile exposure, or cross-session reuse. Lack of security guidance increases the chance secrets will be stored insecurely, left behind in files, or exposed to other processes and future tasks.

Ssd 3

High

Confidence: 96% confidence
Finding: The file explicitly tells the agent to ask the user to paste an API key and later solicit OTP-based verification material. Collecting raw authentication secrets in normal conversation is dangerous because it normalizes secret exfiltration through chat and increases the chance of logging, replay, or accidental disclosure.

Ssd 3

High

Confidence: 97% confidence
Finding: The workflow instructs the agent to save raw auth responses containing tokens to temporary files and later persist the resulting API key across sessions. Writing secrets to files and long-term environment storage creates multiple leakage points, including filesystem residue, backups, logs, and access by unrelated processes or future agent runs.

Ssd 3

High

Confidence: 95% confidence
Finding: The document directs the agent to request a user's email OTP and complete account verification on the user's behalf, effectively making the agent an intermediary in a sensitive authentication flow. This enables credential capture and account takeover risk if the workflow is abused, and it is especially inappropriate in a skill whose purpose is unrelated to identity or account administration.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.