Security audit

tl;dw - YouTube Video Summarizer

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it asks users to provide YouTube browser cookies while disabling TLS certificate verification for part of the download flow.

Review before installing. Use this only with public videos unless you are comfortable handling YouTube cookies like passwords. Avoid exporting browser cookies from a primary account, do not leave cookie files in shared directories, delete them after use, and be aware that captions and video metadata are cached locally. The TLS certificate bypass should be fixed before using cookies or running on untrusted networks.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/extract_transcript.py:87
Finding: TLS Certificate Verification Disabled for yt-dlp Network Requests
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:99
Finding: Unpinned Third-Party Package Installation and Unrestricted Upgrades
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation instructs users to export browser cookies and supply them to the tool, but it does not warn that these cookies are authenticated session secrets that can grant account access if mishandled. Encouraging storage of such files in the skill directory without guidance on permissions, scope, rotation, or deletion increases the risk of credential theft or unintended reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The script makes outbound requests to YouTube/caption URLs and persists downloaded metadata and captions to a local cache without explicit user-facing notice beyond implementation details. In a skill context, this can create privacy and operational surprises: users may not realize a provided URL triggers network access and that transcript/metadata artifacts remain on disk, potentially exposing viewing interests or retained content to other local users/processes.
Content: No source excerpt is available for this finding.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 592)May include surrounding context.
text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · LICENSE.txt (reported line 604)May include surrounding context.
text
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill explicitly states that transcripts are cached locally, but it does not clearly warn that video-derived content and metadata will be written to disk and may persist after the session. This can expose potentially sensitive viewing-related content to other local users, backups, or later forensic inspection, especially in shared or managed environments.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The top-level docstring and CLI description describe the script as extracting YouTube transcripts, suggesting a narrow purpose. However, when --json is used, the code returns a larger metadata bundle from L451-L464, which goes beyond transcript extraction and contradicts the narrow framing in the documentation.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.