Security audit
Security checks for vulnerabilities and agentic risk
The skill’s playlist/transcript purpose is coherent, but its setup guide asks agents to collect and persist API credentials and work around redaction by writing raw auth responses to files.
Review this skill carefully before installing. It needs a TranscriptAPI key and may ask the agent to create an account, handle an email verification code, and store a long-lived key for future sessions. Prefer creating the account and storing the secret yourself through a trusted secret manager, and avoid letting an agent write raw token responses to general temporary files.
The document is for a YouTube playlist skill, but it embeds full onboarding and credential-management instructions for an unrelated third-party TranscriptAPI service. That scope expansion enables the agent to solicit, obtain, and persist secrets well beyond the skill's declared purpose, increasing the chance of unauthorized account actions and long-term secret exposure.
The instructions explicitly tell the agent to ask the user to paste an API key or provide an OTP, then store the resulting key for future reuse. Collecting and retaining user secrets across sessions is dangerous because it centralizes sensitive credentials in the agent environment and enables later unauthorized use if that environment is compromised or reused unexpectedly.
These instructions tell the agent to register a third-party account on the user's behalf, trigger OTP delivery, and complete verification. For a playlist-browsing/research skill, this is an unjustified identity and account-management capability that could be abused to create or manipulate external accounts using user email addresses.
This step instructs the agent to write raw authentication responses containing access tokens to temporary files specifically to bypass runtime redaction protections. Deliberately evading protective secret-redaction controls materially increases the risk of credential theft, leakage to disk, and unauthorized reuse by other processes or later sessions.
The verify flow repeats the same bypass pattern for the final API key, directing the agent to save the raw response and extract the api_key from a file rather than allowing redaction. This is especially dangerous because it targets the long-lived secret itself, creating an intentional path to defeat safeguards and persist a reusable credential.
The file directs the agent to store a third-party API key persistently across sessions and shells, despite the skill being playlist-focused. Persistent secret retention creates a durable foothold for future misuse and broadens the blast radius if the agent environment, logs, or config files are later accessed by other skills or users.
The guide instructs the agent to collect API keys, OTPs, and temporary bearer tokens, but it does not present a clear user-facing warning about the sensitivity of those credentials or the implications of storing them persistently. This undermines informed consent and makes accidental oversharing or unsafe storage more likely.
The skill routes user-supplied YouTube playlist URLs/IDs and related request metadata to transcriptapi.com, but it does not clearly disclose that this third-party service receives that data. While the transmitted data is not highly sensitive by default, undisclosed third-party sharing can expose user research interests, channel associations, and access patterns, creating a privacy and transparency issue.
No suspicious patterns detected.
