Youtube Lecture Analyzer

• Outcome: Review
• Latest audit: Sep 11, 2026 · 1:14 AM UTC
• Version: 1.0.1

Overview

This skill appears to do what it says: fetch YouTube captions and create a lecture summary, with some privacy and dependency caveats.

Install only if you are comfortable with a Python script fetching YouTube transcript data through the configured localhost proxy and saving a transcript-containing report in the current directory. Do not rely on --summary-only for privacy until that flag is fixed, and prefer pinned dependencies before using it in sensitive environments.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: _meta.json:9

Finding

Unpinned Third-Party Dependencies Create a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: _meta.json, line 9; SKILL.md, lines 35–38; scripts/analyze_lecture.py, line 21
Vulnerability Type: Unpinned third-party dependencies
Risk Level: Medium

Vulnerable Code

_meta.json, line 9:

json

"dependencies": ["youtube-transcript-api", "requests"],

SKILL.md, lines 35–38:

markdown

## 依赖
- youtube-transcript-api
- HTTP 代理：127.0.0.1:26739

scripts/analyze_lecture.py, line 21:

python

from youtube_transcript_api import YouTubeTranscriptApi

Technical Analysis

The Skill declares youtube-transcript-api and requests without version constraints or cryptographic integrity hashes. Consequently, dependency resolution can select whichever release is current at installation time rather than a version that was reviewed together with the Skill.

Python packages can execute package-controlled code during installation and module import. The script directly imports youtube_transcript_api, so a malicious or compromised resolved release could execute code under the identity of the user or Agent running the Skill. The declared requests package is not used by the audited script, unnecessarily increasing the dependency and supply-chain attack surface.

The audited files do not demonstrate that either named package is currently malicious, and no dependency-confusion namespace or typosquatted package name was identified. The vulnerability is the absence of reproducible, integrity-verified dependency resolution, which leaves future installations exposed to package-registry, maintainer-account, or release-pipeline compromise.

Attack Path

1. An attacker compromises a dependency maintainer account, package registry, or release pipeline for one of the unconstrained dependencies.
2. The attacker publishes a malicious release under the legitimate dependency name.
3. A user or automated environment installs the Skill and resolves de ...[truncated 1089 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every runtime dependency to an explicitly reviewed version, for example:

   json

   "dependencies": [
     "youtube-transcript-api==REVIEWED_VERSION"
   ]
   

2. Remove requests if it is not directly required by the Skill. Transitive dependencies should be resolved through a generated lockfile rather than redundantly declared.

3. Generate and commit a reproducible dependency lockfile containing exact versions for direct and transitive dependencies.

4. Require cryptographic hashes during installation, such as through a hash-locked requirements file and pip install --require-hashes.

5. Install packages only from an authenticated, approved registry, and disable unintended extra package indexes to reduce dependency-confusion exposure.

6. Run automated dependency vulnerability and provenance checks before publishing updates.

7. Review dependency release notes and source changes before updating pinned versions.

8. Install and execute the Skill in a least-privileged, isolated environment with restricted filesystem, credential, and network access.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The output specification requires a summary in Chinese and English, and the rest of the document is framed as a Chinese-language output format without indicating that users can opt into another locale. This can violate language/locale policy when a skill forces a specific language absent user choice or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The manifest presents the skill in Chinese and specifies that reports include Chinese and English summaries, which imposes a language/locale expectation in the skill metadata. There is no indication that users can choose language preferences or that the locale restriction is required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code file contains natural-language instructions stating the tool is a Chinese lecture transcript analyzer and its interface assumes Chinese by default while also producing mandatory Chinese and English summaries. That imposes language behavior on users without offering a language/locale choice or documenting it as an optional setting.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script advertises a '--summary-only' mode and parses the flag, but never uses it to suppress transcript persistence. As a result, users who expect a limited-output mode may unintentionally save up to 10,000 characters of transcript content to disk, causing privacy, confidentiality, or compliance issues when analyzing non-public or sensitive videos.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The printed labels and saved report content are hard-coded in Chinese, and the script always generates both Chinese and English summaries regardless of user preference. This is a natural-language policy concern because the skill does not provide opt-in or selection for language/locale behavior.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: _meta.json:11