Security audit

YouTube Video Summarizer (Xiaolongxia)

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a legitimate YouTube summarization aid, with network fetching and optional saving/publishing features that users should control deliberately.

Before installing, be aware that using this skill will make web requests to YouTube and search/news providers based on the video you ask about. Do not allow it to save summaries to memory files or prepare EvoMap publication unless you explicitly want that content retained or shared.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims to provide end-to-end YouTube summarization, related-news search, and structured summary generation, but the only concrete implementation detail shown is a helper script for metadata/transcript retrieval while the summarization logic remains instructional. This mismatch can mislead users and orchestration systems about what code actually runs, causing over-trust, improper permissioning, and unexpected data handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The skill claims to provide end-to-end YouTube summarization, related-news search, and structured summary generation, but the only concrete implementation detail shown is a helper script for metadata/transcript retrieval while the summarization logic remains instructional. This mismatch can mislead users and orchestration systems about what code actually runs, causing over-trust, improper permissioning, and unexpected data handling.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill claims to provide end-to-end YouTube summarization, related-news search, and structured summary generation, but the only concrete implementation detail shown is a helper script for metadata/transcript retrieval while the summarization logic remains instructional. This mismatch can mislead users and orchestration systems about what code actually runs, causing over-trust, improper permissioning, and unexpected data handling.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 249)May include surrounding context.
md
**位置：** `scripts/youtube-info.js` (相对于 SKILL.md)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill documents direct shell execution of a helper script but does not declare any tool restrictions such as allowed-tools or permissions. That creates an unnecessary execution surface where an agent may invoke shell commands without explicit scope, increasing the chance of unintended command execution or abuse if the script or invocation path is modified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill instructs use of web_fetch and web_search against YouTube and third-party sources, but does not clearly notify the user that external network requests and possible data disclosure will occur. In a summarization context this matters because user-supplied links, queries, and derived context may be transmitted to outside services unexpectedly.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation introduces memory persistence and EvoMap publishing capabilities unrelated to the stated YouTube summarization function. Adding unrelated storage or external publishing paths broadens the data-exposure surface and can lead to retention or transmission of user-derived content beyond what the user expects.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases are broad natural-language expressions likely to appear in ordinary conversation. Overbroad auto-triggering can cause the skill to activate unexpectedly, leading to unsolicited web access, transcript retrieval, or other side effects without the user's clear intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTTP request hard-codes Accept-Language: 'en-US,en;q=0.9', which imposes a specific locale on fetched content regardless of user preference. This is a natural-language/locale policy issue because the script does not offer a language choice for page retrieval or explain why English is required.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The help text states the default subtitle selection is 'prefer Chinese, then English', and the implementation follows that policy. This enforces language prioritization without first asking the user, rather than offering a neutral default or explicit opt-in to a preferred locale.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 78% confidence
Finding: The SKILL.md actively documents a helper script as providing transcript retrieval, timestamped subtitle output, language selection, and JSON output. In the provided file, this is only asserted in documentation and example commands; there is no corresponding code here to verify that the documented behavior matches implementation, creating a documentation-to-implementation gap within the analyzed artifact.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.