ClawHub
Back to skill

Security audit

YouTube Notes

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its YouTube-notes purpose, but it tells users to paste an API key into chat and leaves credential storage too vague.

Review before installing. Configure TRANSCRIPT_API_KEY through a protected secret manager or environment setting, not by pasting it into chat. Assume any video URL or ID you provide may be sent to TranscriptAPI.com and YouTube, so avoid private, unlisted, or sensitive links unless that disclosure is acceptable.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:27
Finding

Insecure API Key Collection Through Conversational Input

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 27–32
Vulnerability Type: Sensitive credential exposure through insecure collection and storage guidance
Risk Level: Medium

Vulnerable Code

markdown
If the user hasn't provided a key yet, tell them:
> "To fetch YouTube transcripts I need a TranscriptAPI.com API key. It's free — sign up at transcriptapi.com, copy your API key from the dashboard, and paste it here."

Store the key as `TRANSCRIPT_API_KEY` wherever your agent manages credentials.

Technical Analysis

The Skill explicitly directs users to paste a TranscriptAPI bearer credential into the conversation. Conversational input may be retained in chat history, agent traces, telemetry, debugging logs, persistent memory, or downstream integrations. The subsequent instruction to store the key “wherever” credentials are managed does not mandate a protected secret store, prohibit plaintext persistence, or require redaction from logs and model output.

The manifest correctly declares TRANSCRIPT_API_KEY as a required environment variable, so collecting it through chat exceeds the minimum privilege and exposure necessary. The credential should instead be provisioned directly through the hosting platform’s secret manager or environment configuration.

The transcript request itself sends the bearer credential only to the declared service:

bash
curl -s "https://transcriptapi.com/api/v2/youtube/transcript?video_url=VIDEO_ID&format=json&include_timestamp=true&send_metadata=true" \
  -H "Authorization: Bearer YOUR_API_KEY"

No transmission of the key to an unrelated endpoint was identified. The vulnerability is the insecure collection and potentially ambiguous storage process, rather than confirmed malicious exfiltration.

Attack Path

  1. A user follows the Skill’s setup instruction and pastes their TranscriptAPI key into the conversation.
  2. The plaintext credential becomes part of the agent’s conversational context and ...[truncated 1025 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the instruction asking users to paste API keys into conversational input.
  2. Direct users to configure TRANSCRIPT_API_KEY through the agent platform’s protected secret manager or process environment.
  3. Fail safely when the variable is absent, providing setup instructions that never request disclosure of the secret’s value.
  4. Explicitly prohibit logging, echoing, displaying, persisting in ordinary files, or including the credential in generated output.
  5. Ensure command execution injects the credential directly from the protected environment rather than interpolating it into visible command histories or diagnostics.
  6. Redact Authorization headers and values matching credential patterns from telemetry, traces, errors, and debugging output.
  7. Scope the API key to the minimum service permissions available, apply quota limits where supported, and provide key rotation and revocation guidance.
  8. Replace the affected guidance with wording such as:
markdown
Configure `TRANSCRIPT_API_KEY` using your agent platform's secret manager.
Do not paste the key into chat. The Skill must read it only from the protected
environment and must never log, display, or persist its value.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill instructs the agent to send the user-supplied YouTube URL or video ID to TranscriptAPI.com and to fetch the YouTube page, but it does not clearly warn the user that their request will trigger outbound network access and disclosure of the video identifier to a third party. This can expose user interests, private/unlisted video links, or other sensitive context without informed consent, especially if users assume summarization happens locally.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.