tl;dw - YouTube Video Summarizer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:56 AM UTC
• Version: 1.0.2

Overview

The skill does what it claims, but it asks users to provide YouTube browser cookies while disabling TLS certificate verification for part of the download flow.

Review before installing. Use this only with public videos unless you are comfortable handling YouTube cookies like passwords. Avoid exporting browser cookies from a primary account, do not leave cookie files in shared directories, delete them after use, and be aware that captions and video metadata are cached locally. The TLS certificate bypass should be fixed before using cookies or running on untrusted networks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract_transcript.py:87
• Finding: TLS Certificate Verification Disabled for yt-dlp Network Requests<![CDATA[ ## Vulnerability Details **File Location**: `scripts/extract_transcript.py:79-91` **Vulnerability Type**: Improper certificate validation **Risk Level**: High ### Vulnerable Code ```python self.ydl_opts = { 'writesubtitles': True, 'writeannotations': True, 'writeautomaticsub': True, 'subtitleslangs': ['en', 'en-US', 'en-CA'], 'skip_download': True, 'quiet': False, 'no_warnings': False, 'no_playlist': True, # Enhanced reliability (from user's yt-dlp config) 'nocheckcertificate': True, # Bypass SSL issues 'retries': 100, 'fragment_retries': 100, 'continuedl': True, } ``` ### Technical Analysis The `nocheckcertificate` option instructs `yt-dlp` not to validate TLS certificates. HTTPS encryption without certificate validation does not securely authenticate the remote server. An attacker capable of intercepting network traffic can present an arbitrary certificate and impersonate a YouTube or related media endpoint. The setting applies to the `yt-dlp` operations that retrieve video metadata and caption information. When the optional cookie file is configured, authenticated requests may include sensitive session cookies. Disabling certificate validation therefore increases the potential impact beyond transcript manipulation and may expose authentication material to a network-positioned attacker. The separate caption download performed through `requests.get()` retains default certificate verification, but that does not protect the preceding `yt-dlp` metadata and caption-discovery requests. ### Attack Path 1. A user runs the transcript extraction script while connected through a network controlled or monitored by an attacker. 2. The script invokes `yt-dlp` with `nocheckcertificate` enabled. 3. The attacker intercepts a TLS connection to a YouTube-related endpoint and supplies an untrusted certificate. 4. Because certificate validation is disabled, `yt-dlp` accepts the attacker's endpoint. 5. The a ...[truncated 1050 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the insecure option entirely or explicitly enable certificate verification: ```python self.ydl_opts = { 'writesubtitles': True, 'writeannotations': True, 'writeautomaticsub': True, 'subtitleslangs': ['en', 'en-US', 'en-CA'], 'skip_download': True, 'quiet': False, 'no_warnings': False, 'no_playlist': True, 'retries': 100, 'fragment_retries': 100, 'continuedl': True, } ``` 2. Correct certificate-store failures instead of bypassing verification. Install or configure an appropriate CA bundle for the operating environment. 3. Do not offer an insecure fallback that silently disables verification. 4. Protect cookie files with restrictive filesystem permissions and use narrowly scoped, temporary cookies where possible. 5. Add a security regression test that verifies `nocheckcertificate` is absent or false. 6. Document failures caused by invalid certificates as security errors rather than generic connectivity problems. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:99
• Finding: Unpinned Third-Party Package Installation and Unrestricted Upgrades<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:94-102` and `SKILL.md:217-223` **Vulnerability Type**: Uncontrolled third-party dependency resolution **Risk Level**: Medium ### Vulnerable Code Initial installation instructions: ```bash venv/bin/pip install yt-dlp webvtt-py ``` Troubleshooting instructions: ```bash cd tldw/ && \ venv/bin/pip install --upgrade yt-dlp ``` The executable script also imports `requests`, but the documented installation command does not explicitly pin or install it: ```python try: import requests except ImportError: print("Error: requests not installed. Install with: pip install requests") sys.exit(1) ``` ### Technical Analysis The documentation installs package versions dynamically resolved by the Python package index at execution time. It provides no exact versions, lock file, cryptographic hashes, or reviewed dependency snapshot. Consequently, two users following the same instructions at different times may install materially different code. The unrestricted `--upgrade` command further changes executable behavior after the Skill has been reviewed. Python packages and their transitive dependencies can execute code during installation and are imported into the same process that handles cookie paths, cached metadata, captions, and output files. This finding does not establish that the named upstream packages are malicious. The vulnerability is the absence of controls that ensure users install the specific dependency artifacts that were reviewed and tested. ### Attack Path 1. An attacker compromises a future upstream package release, a transitive dependency, a maintainer account, or the package-distribution channel. 2. The user follows the documented unpinned installation or unrestricted upgrade command. 3. `pip` resolves the currently available package versions rather than a reviewed, immutable dependency set. 4. The compromised package is installed in the Skill's virtual environment. 5. Mali ...[truncated 877 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create a reviewed dependency manifest with exact versions for all direct dependencies, including `yt-dlp`, `webvtt-py`, and `requests`. 2. Generate and verify cryptographic hashes for all packages and transitive dependencies. Install with: ```bash venv/bin/pip install --require-hashes -r requirements.txt ``` 3. Replace the unrestricted upgrade instruction with a controlled maintenance process: - Review release notes and security advisories. - Update dependency pins in a dedicated change. - Regenerate hashes. - Run automated tests. - Review the resulting dependency diff before release. 4. Use a lock-generation tool or constraints file to make transitive dependency resolution reproducible. 5. Configure automated dependency vulnerability scanning and provenance checks. 6. Avoid installing dependencies with administrator privileges. 7. Ensure the documented setup explicitly includes every direct import rather than relying on accidental transitive installation. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs users to export browser cookies and supply them to the tool, but it does not warn that these cookies are authenticated session secrets that can grant account access if mishandled. Encouraging storage of such files in the skill directory without guidance on permissions, scope, rotation, or deletion increases the risk of credential theft or unintended reuse.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script makes outbound requests to YouTube/caption URLs and persists downloaded metadata and captions to a local cache without explicit user-facing notice beyond implementation details. In a skill context, this can create privacy and operational surprises: users may not realize a provided URL triggers network access and that transcript/metadata artifacts remain on disk, potentially exposing viewing interests or retained content to other local users/processes.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The skill explicitly states that transcripts are cached locally, but it does not clearly warn that video-derived content and metadata will be written to disk and may persist after the session. This can expose potentially sensitive viewing-related content to other local users, backups, or later forensic inspection, especially in shared or managed environments.

Intent-Code Divergence

Low

• Confidence: 81% confidence
• Finding: The top-level docstring and CLI description describe the script as extracting YouTube transcripts, suggesting a narrow purpose. However, when --json is used, the code returns a larger metadata bundle from L451-L464, which goes beyond transcript extraction and contradicts the narrow framing in the documentation.

Static analysis

No suspicious patterns detected.