Security audit
Security checks for vulnerabilities and agentic risk
The skill's YouTube search function is coherent, but its setup asks agents to collect and persist API credentials, email, and OTP data in a way users should review carefully.
Install only if you are comfortable with the agent using TranscriptAPI for YouTube search and transcript retrieval. Prefer supplying an existing key through a trusted secret manager, avoid pasting credentials into chat when possible, and do not let the agent create an account or persist secrets unless you understand where they will be stored and how to revoke them.
The entire file is focused on TranscriptAPI authentication, token handling, OTP verification, and API-key storage rather than YouTube discovery or search. This mismatch strongly suggests the skill is being used as a vehicle to smuggle unrelated secret-handling behavior into an innocuous context, making the content more dangerous because users would not expect it from a YouTube skill.
The guide tells the agent to persistently store a TranscriptAPI secret so it survives across sessions and non-interactive shells. For a YouTube search skill, this is an unjustified secret-management capability that expands the blast radius of compromise and enables continued access to a third-party service beyond the user's immediate intent.
The instructions explicitly direct the agent to solicit an API key from the user and then persist it, or to create an account and ultimately obtain equivalent credentials. Collecting and retaining secrets across sessions is highly sensitive behavior, and in this skill context it is unrelated to the advertised function, increasing the likelihood of credential theft or misuse.
The document instructs the agent to create a third-party TranscriptAPI account, collect a user email and OTP, and complete verification on the user's behalf. That capability is unrelated to a YouTube search skill and introduces credential-handling and account-creation behavior that could be abused for unauthorized account provisioning or data collection.
The document instructs the agent to capture access tokens and API keys via temporary files and reuse them to complete verification while avoiding visible output. This is dangerous because it operationalizes handling of sensitive credentials and specifically attempts to bypass normal redaction/visibility safeguards, which is a strong indicator of adversarial intent.
The activation guidance is broad enough that the skill may be invoked for generic research tasks without the user explicitly asking to use YouTube or a third-party media service. That can cause unintended disclosure of user queries to an external provider and may steer the agent toward lower-trust sources or away from the user's preferred research modality.
The skill sends user search queries and requested video/transcript targets to TranscriptAPI, but the user-facing description does not warn about this third-party data transfer. This can lead to unconsented disclosure of potentially sensitive research topics, interests, or identifiers contained in search terms or selected URLs.
The guide directs long-term storage of an API key across sessions without clearly informing the user of the privacy, persistence, and security implications. Even if intended as convenience, silent durable storage of credentials increases the chance of misuse, accidental exposure, or retention beyond user expectations.
The staged flow begins with a benign setup question and progressively escalates to collecting email, OTPs, bearer tokens, and persistent API-key storage. This pattern is dangerous because it can socially engineer both the user and the agent into disclosing and retaining increasingly sensitive data under the guise of routine setup, especially in a skill whose declared purpose is unrelated.
The manifest description at L003 limits the skill to searching for videos, channels, creators, and related discovery tasks. However, the skill documentation explicitly states 'Search YouTube and fetch transcripts' and provides a transcript retrieval workflow, which extends beyond pure search/discovery into content extraction.
No suspicious patterns detected.
