tl;dw - YouTube Video Summarizer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:57 AM UTC
• Version: 1.0.2

Overview

The skill has a coherent YouTube transcript-summary purpose, but it under-discloses sensitive cookie handling and disables TLS certificate checks while using network tools.

Review before installing. Use cookie support only if necessary, treat exported cookies like passwords, store them outside the skill directory with restrictive permissions, delete them after use, and prefer a dedicated account. The TLS certificate bypass should be removed before using cookies on untrusted networks. Install dependencies as a non-privileged user and consider pinned, hash-verified packages.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract_transcript.py:87
• Finding: TLS Certificate Verification Is Disabled for yt-dlp Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract_transcript.py:87` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python self.ydl_opts = { 'writesubtitles': True, 'writeannotations': True, 'writeautomaticsub': True, 'subtitleslangs': ['en', 'en-US', 'en-CA'], 'skip_download': True, 'quiet': False, 'no_warnings': False, 'no_playlist': True, # Enhanced reliability (from user's yt-dlp config) 'nocheckcertificate': True, # Bypass SSL issues 'retries': 100, 'fragment_retries': 100, 'continuedl': True, } # Add cookies if provided and file exists if cookies_path and os.path.isfile(cookies_path): print(f'Using cookies from: {cookies_path}') self.ydl_opts['cookiefile'] = cookies_path ``` ### Technical Analysis The `nocheckcertificate` option disables TLS certificate validation for network operations performed by `yt-dlp`. The client may consequently accept an invalid, self-signed, expired, or attacker-controlled certificate instead of verifying that the remote endpoint is authentic. The risk is elevated by the optional cookie-file feature. When a user supplies an authenticated YouTube cookie file, `yt-dlp` may attach applicable session cookies to requests. A network attacker capable of redirecting or intercepting these requests could impersonate the expected server because the presented certificate is not validated. The same weakness also compromises response integrity. An attacker could alter retrieved metadata, subtitle URLs, or other content consumed by the extractor. ### Attack Path 1. A user invokes the extraction script, potentially with `--cookies` to access restricted content. 2. An attacker obtains a privileged network position, controls a configured proxy, compromises DNS resolution, or otherwise redirects outbound traffic. 3. The attacker presents a certificate that would normally fail trust or hostname validation. 4 ...[truncated 866 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the insecure option entirely: ```python # Remove this setting: 'nocheckcertificate': True, ``` 2. Retain the default TLS certificate and hostname validation behavior of `yt-dlp`. 3. If certificate validation fails, repair the system trust store or install an up-to-date CA bundle rather than bypassing validation. 4. Ensure HTTPS proxies are explicitly trusted and centrally controlled where a proxy is required. 5. Avoid using exported account cookies unless necessary. Use a dedicated, minimally privileged account for restricted content. 6. Protect cookie files with restrictive filesystem permissions and delete them when no longer needed. 7. Add a regression test or configuration assertion that rejects `nocheckcertificate`, equivalent certificate-bypass options, and insecure HTTP endpoints. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:99
• Finding: Unpinned and Unverified Python Dependencies Create a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:99` and `SKILL.md:221` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code Setup instructions at line 99: ```bash venv/bin/pip install yt-dlp webvtt-py ``` Update instructions at line 221: ```bash venv/bin/pip install --upgrade yt-dlp ``` The executable script additionally requires `requests`, although the documented installation command does not explicitly pin or install it. ### Technical Analysis The documented installation workflow resolves packages from the configured Python package index without exact version constraints or cryptographic hash verification. The `--upgrade` command deliberately selects a mutable, newer release whenever one is available. As a result, installations performed at different times can obtain different code. If a required package, one of its transitive dependencies, the configured package index, or a maintainer release process is compromised, attacker-controlled package code could execute during installation or later when imported by `extract_transcript.py`. This is a supply-chain hardening weakness rather than evidence that the currently named packages are malicious. The reviewed project does not contain a lock file or hash-pinned requirements manifest that would make dependency resolution reproducible and verifiable. ### Attack Path 1. A user follows the setup or troubleshooting instructions in `SKILL.md`. 2. `pip` resolves the latest package versions and transitive dependencies from its configured package source. 3. A package account, release artifact, dependency, index, or local package-source configuration is compromised. 4. The unresolved command downloads and installs the attacker-controlled release because no reviewed version or hash is enforced. 5. Malicious code executes during package installation or when the installed module or command is subsequently invoked. 6. The payload runs with th ...[truncated 619 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency manifest containing exact versions for every direct and transitive dependency. 2. Generate and enforce cryptographic hashes, for example: ```bash venv/bin/pip install --require-hashes -r requirements.txt ``` 3. Include all actual runtime dependencies, including `yt-dlp`, `webvtt-py`, and `requests`, in the controlled dependency set. 4. Replace the unrestricted upgrade instruction with a controlled update process: - update dependencies in a separate review branch; - inspect release notes and dependency changes; - run security and functional tests; - regenerate hashes; - commit the updated lock file. 5. Use a trusted package index over validated TLS and review any environment-specific index or mirror configuration. 6. Run installation and execution as a non-privileged user, never with `sudo` or an administrative account. 7. Add automated dependency vulnerability scanning while recognizing that scanning supplements, but does not replace, pinning and hash verification. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to export browser cookies and use them to access age-restricted or members-only YouTube content, but it does not warn that cookie files may contain active session credentials tied to the user's account. If those cookies are exposed, reused, or stored insecurely, an attacker or downstream tool could gain authenticated access to the user's YouTube/Google session or account-linked data.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Static analysis

No suspicious patterns detected.