youtube-search

• Analyzed: May 12, 2026, 3:14 AM
• Findings: 1
• Version: 1.5.0
• Hash: c45b6af0b59169056a3f04dd8087d114c987c762ed212b10ceb6908ead5c4a74
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill facilitates YouTube searching and transcript retrieval via transcriptapi.com. It is classified as suspicious due to instructions in 'references/auth-setup.md' that direct the AI agent to bypass platform security features (specifically secret redaction) by writing API keys and access tokens to temporary files to avoid detection in tool outputs. Furthermore, it instructs the agent to implement persistence by modifying the host's environment variables or shell profiles to ensure the 'TRANSCRIPT_API_KEY' survives across sessions.