YouTube to Chinese

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:41 PM UTC
• Version: 1.0.0

Overview

This YouTube transcription skill is coherent, but it needs review because it can use browser cookies and a mutable downloader from /tmp without enough warning or verification.

Install only if you are comfortable with a workflow that may access YouTube through your browser cookies and may run a downloaded yt-dlp binary from /tmp. Prefer using an already installed, trusted yt-dlp, avoid browser:chrome unless absolutely necessary, and treat any cookies.txt file as sensitive account data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:67

Finding

Unverified Mutable Executable Is Downloaded and Preferentially Executed

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:67; scripts/download_audio.sh:19-20; related cookie handling at scripts/download_audio.sh:31-36
Vulnerability Type: Remote payload retrieval and execution without integrity verification
Risk Level: Medium

Vulnerable Code

SKILL.md:67:

bash

curl -sL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /tmp/yt-dlp && chmod +x /tmp/yt-dlp

scripts/download_audio.sh:19-20:

bash

if [[ -x "/tmp/yt-dlp" ]]; then
  YT_DLP="/tmp/yt-dlp"

Related sensitive cookie access at scripts/download_audio.sh:31-36:

bash

if [[ -n "$COOKIES" && -f "$COOKIES" ]]; then
  COOKIE_ARGS=(--cookies "$COOKIES")
elif [[ -n "$COOKIES" && "$COOKIES" == browser:* ]]; then
  # e.g. COOKIES="browser:chrome"
  BROWSER="${COOKIES#browser:}"
  COOKIE_ARGS=(--cookies-from-browser "$BROWSER")
fi

Technical Analysis

The documented recovery procedure retrieves the mutable latest release of yt-dlp, writes it to /tmp/yt-dlp, marks it executable, and performs no checksum or signature verification. The download script then gives this temporary executable priority over both the system PATH and the packaged virtual-environment installation.

This creates a remote payload execution and local tool-substitution boundary: the effective code executed by the Skill can change after review. Because /tmp is conventionally a shared temporary location, trusting a fixed path there also risks executing a file placed or replaced by another local process where filesystem permissions and host configuration permit it.

The official GitHub release URL and HTTPS reduce routine interception risk, and the reviewed code does not establish malicious intent. They do not, however, provide artifact pinning or independent integrity validation. The risk becomes more consequential when the optional browser-cookie mode is used, becau ...[truncated 1785 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yt-dlp to a reviewed, explicit release version rather than using the mutable latest URL.
2. Obtain the expected SHA-256 digest through a trusted release process and verify it before making the file executable or invoking it. Abort on any mismatch.
3. Where upstream signing is available, verify the release signature using a pinned and trusted signing key.
4. Prefer an operating-system package, locked dependency, or pre-provisioned binary managed by the deployment process instead of downloading executable code during Skill operation.
5. Do not preferentially execute a fixed binary from /tmp. Store managed executables in a directory owned by the Agent account or administrator and not writable by other users.
6. If temporary storage is unavoidable, create a private directory with restrictive permissions, use collision-resistant paths, verify ownership and file type, and reject symbolic links or unexpected pre-existing files.
7. Remove the /tmp/yt-dlp precedence rule or validate the file's ownership, permissions, version, and digest before selecting it.
8. Treat browser-cookie access as sensitive: require explicit user approval, warn about the exposure risk, and prefer a narrowly scoped exported cookie file over access to an entire browser profile.
9. Execute the downloader with the minimum required filesystem and network privileges, ideally in a sandbox that cannot access unrelated credentials or user data.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 88% confidence

Finding

The YARA hit is triggered by instructions to obtain cookies from Chrome or export cookies.txt, which resembles credential-harvesting behavior. Although the apparent goal is to bypass YouTube bot detection rather than steal credentials, the mechanism still involves accessing sensitive browser authentication material. In a transcription skill, that capability is unusually sensitive and materially increases risk.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

t chinese.

YouTube → 中文稿

将 YouTube 视频音频下载后，用 AI 转录并整理为结构化中文输出。

工作流程

第一步：下载音频

bash

bash <skill_dir>/scripts/download_audio.sh "<YouTube_URL>" /tmp/yt-audio

脚本输出文件路径（stdout），失败时输出错误说明（stderr）并退出非零码。

可选参数：

• 第 3 参数传 cookies 文件路径（/path/to/cookies.txt）或 browser:chrome（从 Chrome 读取 cookies）
• 若遇到 bot 检测错误，见下方「常见问题」

第二步：AI 转录

用 audios_understand 工具转录音频文件：

text

audios_understand([{
  "file": "<第一步输出的文件路径>",
  "prompt": "请完整转录这段音频的所有内容，保留说话者的原意，不要遗漏任何部分。输出语言为中文。"
}])

注意： audios_understand 是 OpenClaw 内置工具，直接传本地文件路径即可，无需上传。

第三步：整理输

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

**音频文件清理**

处理完成后删除临时文件：`rm -rf /tmp/yt-audio /tmp/yt-test`

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md

**音频文件清理**

处理完成后删除临时文件：`rm -rf /tmp/yt-audio /tmp/yt-test`

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/download_audio.sh (reported line 39)May include surrounding context.

sh

echo "ERROR: yt-dlp not found. Install with:" >&2
  echo "  curl -sL https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /tmp/yt-dlp && chmod +x /tmp/yt-dlp" >&2
  exit 2
fi

mkdir -p "$OUT_DIR"

# Build cookie args
COOKIE_ARGS=()
if [[ -n "$COOKIES" && -f "$COOKIES" ]]; then
  COOKIE_ARGS=(--cookies "$COOKIES")
elif [[ -n "$COOKIES" && "$COOKIES" == browser:* ]]; then
  # e.g. COOKIES="browser:chrome"
  BROWSER="${COOKIES#browser:}"
  COOKIE_ARGS=(--cookies-from-browser "$BROWSER")
fi

# Download best audio, convert to mp3, print file path
"$YT_DLP" \
  -x \
  --audio-format mp3 \
  --audio-quality 0 \
  -o "$OUT_DIR/%(title)s.%(ext)s" \
  --print after_move:filepath \
  --no-playlist \
  "${COOKIE_ARGS[@]+"${COOKIE_ARGS[@]}"}" \
  "$URL" || {
    echo "ERROR: Download failed. If YouTube blocks the request, try:" >&2
    echo "  1. Export cookies: yt-dlp --cookies-from-browser chrome ..." >&2
    echo "  2. Use a cookies.txt file as the 3rd argument" >&2
    exit 3

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly instructs using Chrome/browser cookies or a cookies.txt file to bypass YouTube access restrictions. That expands the skill from simple media processing into access to authenticated browser data, which can expose session tokens and account-scoped content if mishandled. In the context of a transcription skill, this is more dangerous because browser credential material is not necessary for the core function in normal cases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes reading browser cookies or cookie exports without prominently warning that these artifacts may contain sensitive authenticated session data. Users could unknowingly expose account access or private viewing context when attempting a routine transcription task. The mismatch between the simple advertised purpose and the sensitive data involved increases the risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The transcription prompt explicitly says '输出语言为中文', which imposes a specific language choice. Under the policy, language constraints should not be forced unless the user is given a choice or the restriction is clearly documented as justified.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The troubleshooting guidance tells the operator to download and execute a replacement yt-dlp binary directly from GitHub into /tmp. This introduces remote code acquisition and execution outside the core skill behavior, creating supply-chain and integrity risks if the binary is tampered with, replaced, or fetched without verification. In a documentation-driven skill, such advice can lead to unsafe operational behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The skill directs downloading audio into /tmp and later deleting local files, but it does not clearly warn users that local artifacts will be created and removed. This is mainly a transparency and privacy issue: users may not expect transient copies of media content to be stored on disk. The surrounding context makes it lower severity because the files are related to the stated task, but disclosure is still insufficient.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.