Security audit
YouTube to Chinese
Security checks across malware telemetry and agentic risk
Overview
The skill matches its YouTube transcription purpose, but it can read Chrome login cookies for YouTube without clearly warning users that those are sensitive session credentials.
Use this skill on public YouTube videos without cookies when possible. If cookies are required, prefer a narrowly exported cookies.txt file, understand that browser:chrome can use your logged-in YouTube session, and install yt-dlp through a trusted or verified method.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.