Felo YouTube Subtitling

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:38 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent subtitle-fetching purpose, but its bundled script can send the Felo API key to an arbitrary API base URL if the environment is influenced.

Install only if you are comfortable sending requested YouTube video IDs and your Felo API key to Felo. Prefer the bundled script, avoid the unpinned global CLI unless separately reviewed, and do not set FELO_API_BASE except to a trusted HTTPS Felo endpoint; rotate the key if it may have been used with an untrusted base URL.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/run_youtube_subtitling.mjs:179

Finding

Bearer API Key Can Be Redirected to an Arbitrary or Plaintext Endpoint

Content

View full analysis

Vulnerability Details

File Location: scripts/run_youtube_subtitling.mjs:179-205
Vulnerability Type: Unrestricted credential destination and insecure transport
Risk Level: High

javascript

const apiBase = (process.env.FELO_API_BASE?.trim() || DEFAULT_API_BASE).replace(/\/$/, '');

const spinnerId = startSpinner(`Fetching subtitles ${videoCode}`);

try {
  const params = new URLSearchParams({ video_code: videoCode });
  if (args.language) params.set('language', args.language);
  if (args.withTime) params.set('with_time', 'true');

  const url = `${apiBase}/v2/youtube/subtitling?${params.toString()}`;

  const payload = await fetchJson(
    url,
    {
      method: 'GET',
      headers: {
        Accept: 'application/json',
        Authorization: `Bearer ${apiKey}`,
      },
    },
    DEFAULT_TIMEOUT_MS
  );

Technical Analysis

The script obtains a sensitive Felo bearer credential from FELO_API_KEY, but allows its destination to be controlled through FELO_API_BASE. The override is accepted without validating its URL scheme or hostname.

Consequently, the Authorization header is attached to requests sent to any endpoint selected through the environment variable. An attacker who can influence the launch environment could set the base URL to an attacker-controlled HTTPS server and directly collect the credential. The script also accepts an http:// URL, allowing the credential and request metadata to traverse the network without transport encryption.

A configurable endpoint may be useful for development or testing, but forwarding a production credential to an unrestricted destination exceeds the minimum privileges needed to fetch subtitles from the declared Felo API.

Attack Path

1. An attacker gains the ability to influence the environment used to launch the Skill, such as through a wrapper script, compromised shell configuration, CI configuration, or agent runtime se ...[truncated 1148 chars]

Remediation

View remediation

Remediation Suggestions

• Remove FELO_API_BASE support if alternate service endpoints are not required for production operation.
• If endpoint customization is required, parse the configured value with URL and require the https: protocol.
• Maintain an explicit allowlist of trusted hosts, such as openapi.felo.ai, before attaching the authorization header.
• Reject URLs containing embedded credentials, unexpected ports, fragments, or unapproved subdomains.
• Construct the API URL with new URL() rather than string concatenation.
• Separate production credentials from development credentials. Test endpoints must use restricted test keys.
• Ensure redirects are either disabled or validated so that an approved endpoint cannot redirect an authenticated request to an untrusted host.
• Document the endpoint override as security-sensitive and avoid inheriting it from untrusted execution environments.
• Revoke and rotate any API key that may have been used while FELO_API_BASE pointed to an untrusted or plaintext endpoint.

A hardened implementation should validate the destination before adding the credential:

javascript

const configuredBase = process.env.FELO_API_BASE?.trim() || DEFAULT_API_BASE;
const baseUrl = new URL(configuredBase);

if (baseUrl.protocol !== 'https:' || baseUrl.hostname !== 'openapi.felo.ai') {
  throw new Error('FELO_API_BASE must use the approved HTTPS endpoint');
}

const url = new URL('/v2/youtube/subtitling', baseUrl);
url.search = params.toString();

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:51

Finding

Documentation Recommends Installing an Unpinned Global Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:51-55
Additional Location: README.md:32-34
Vulnerability Type: Unpinned third-party dependency and global installation guidance
Risk Level: Medium

markdown

**Packaged CLI** (after `npm install -g felo-ai`):

```bash
felo youtube-subtitling -v "dQw4w9WgXcQ" [options]
# Short forms: -v (video-code), -l (language), -j (json)

text

The README also presents execution of the globally installed CLI:

```markdown
# After npm install -g felo-ai: CLI
felo youtube-subtitling -v "https://youtu.be/dQw4w9WgXcQ"
felo youtube-subtitling -v "dQw4w9WgXcQ"

Technical Analysis

The documentation recommends npm install -g felo-ai without pinning a specific reviewed version or providing integrity verification. The package's implementation is not included in this project and was therefore outside the audited source.

An unpinned installation resolves to whichever release is current at installation time. Its effective behavior can change after this Skill has been reviewed. npm packages may also define lifecycle scripts that execute during installation. A global installation increases exposure because it places package files and executables in a shared user or system environment.

This is a supply-chain weakness rather than evidence that the named package is currently malicious. Exploitation depends on compromise of the package, its publisher account, the registry delivery path, or a future unsafe release.

Attack Path

1. The felo-ai package, its maintainer account, or a future package release is compromised.
2. An attacker publishes a malicious version under the same package name.
3. A user follows the Skill documentation and runs npm install -g felo-ai without a version constraint.
4. npm retrieves the current compromised release.
5. Malicious package code may run through an installation lifecycle script or when the user invokes the ins ...[truncated 688 chars]

Remediation

View remediation

Remediation Suggestions

• Prefer the bundled, auditable script over an externally maintained global CLI.
• Pin the CLI to a specifically reviewed version, for example felo-ai@X.Y.Z.
• Use a lockfile-backed local project dependency rather than a global installation.
• Record and verify package integrity information and package provenance before installation.
• Review package lifecycle scripts and consider installation with scripts disabled when they are unnecessary.
• Avoid recommending installation with sudo, administrator accounts, or other elevated privileges.
• Document that the packaged CLI is separate from the audited repository code and requires its own security review.
• Establish a release-update process in which new dependency versions are reviewed before the documentation's pinned version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill documents use of environment variables and outbound network access to a third-party API, but it does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes the skill harder to govern, review, and sandbox safely if executed in an agent environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill instructs sending a user-supplied YouTube URL or video ID to Felo's external API without clearly disclosing that this shares user-provided data with a third party. While a video ID is usually low sensitivity, it can still reveal user interests, internal training links, or unlisted video references, so omission of the privacy notice creates a transparency and data-handling risk.

Content

No source excerpt is available for this finding.