youtube-channels

• Analyzed: May 12, 2026, 3:14 AM
• Findings: 1
• Version: 1.5.0
• Hash: a7a485db16b7b35713e9faf60091d6a43e81acefb3619474b048bae5320b91c7
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides YouTube channel metadata and search capabilities via transcriptapi.com. It is classified as suspicious because references/auth-setup.md contains explicit instructions for the AI agent to bypass host-level security redaction filters. Specifically, it directs the agent to write sensitive API tokens (access_token and api_key) to temporary files to prevent the platform from masking them in command output. While this is intended to facilitate the setup of the TRANSCRIPT_API_KEY, providing instructions to circumvent security controls is a high-risk behavior. The skill also requests persistence of environment variables in shell profiles.