Security audit

yt

Security checks for vulnerabilities and agentic risk

Overview

Review is recommended because the YouTube lookup skill is coherent, but its setup flow asks the agent to handle third-party signup, email/OTP verification, and broad persistent API-key storage.

Install only if you are comfortable using TranscriptAPI as the backend service. Prefer creating the TranscriptAPI account yourself, supplying a key through a scoped secret manager, and avoiding broad shell-profile or global environment persistence unless you understand who can read it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This document gives the YouTube skill authority to create third-party TranscriptAPI accounts, collect user email and OTPs, handle bearer tokens, and persist API secrets. That is materially broader than the skill's stated YouTube lookup/search/transcript purpose, so it expands the skill into account creation and secret-handling workflows that increase phishing, privacy, and credential-compromise risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file instructs the agent to persistently store an API key so it survives across sessions and non-interactive shells, which is a powerful secret-management action unrelated to a simple YouTube content skill. Persistent environment-level storage can expose the key to other tools, subprocesses, future sessions, or misconfigured environments, creating lasting compromise beyond the immediate task.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill description is broad enough to match many generic requests such as summaries, lookups, or topic searches even when the user did not explicitly ask for YouTube. That can cause unnecessary skill activation, expanding data exposure to an external service and increasing the chance the agent routes unrelated user content into this skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The guide normalizes obtaining and persisting an API key across future sessions without clearly warning the user that this creates a long-lived credential footprint on the machine. Users may unknowingly allow storage in locations readable by other processes or future agent tasks, increasing the chance of accidental disclosure or misuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to collect a user's email address and transmit it to a third-party service to create an account, but it does not provide a clear privacy disclosure or obtain explicit informed consent for that data-sharing step. In skill context, this is more dangerous because a YouTube utility would not reasonably lead users to expect off-platform account creation and email/OTP handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.