YouTube Transcript

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:35 AM UTC
• Version: 1.0.1

Overview

This YouTube transcript skill is mostly transparent about its purpose, but it can change host VPN/routing settings and contact an extra metadata service, so it should be reviewed before use.

Install only if you intentionally want transcript requests routed through a residential VPN/proxy and you are comfortable with host-level WireGuard and routing changes. Prefer running it as an unprivileged user in an isolated environment, preconfigure networking outside the skill, pin dependencies, and treat noembed.com as an additional party that can see requested video IDs.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/fetch_transcript.py:45
• Finding: Automatic Privileged Host Network Modification## Vulnerability Details **File Location**: `scripts/fetch_transcript.py`, lines 45-56 **Vulnerability Type**: Automatic execution of privileged network-management commands **Risk Level**: High ### Vulnerable Code ```python def bring_up_vpn(): """Attempt to bring up VPN.""" try: subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10) subprocess.run( ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"], capture_output=True, timeout=5 ) return check_vpn() except Exception as e: return False, str(e) ``` ### Technical Analysis When the expected VPN is unavailable, the script automatically invokes `wg-quick` and modifies the host policy-routing table. These operations affect system-wide networking and ordinarily require root privileges or the `CAP_NET_ADMIN` capability. Fixed argument arrays are used rather than a shell command, so no command-injection path was identified. However, invoking `wg-quick up wg0` causes the host to process the existing WireGuard configuration for `wg0`, which may include routing changes or configuration hooks. The operation therefore exceeds the minimum privileges required merely to retrieve a transcript. The script also ignores the return codes from both commands. Consequently, it cannot reliably distinguish successful configuration from partial failure. Repeated executions can attempt to add the same policy-routing rule multiple times. ### Attack Path 1. The script is run by an agent or service account with root privileges or network-administration capabilities. 2. `check_vpn()` reports that `wg0` is unavailable or lacks a handshake. 3. The script automatically executes `wg-quick up wg0`. 4. The host processes `/etc/wireguard/wg0.conf` and applies its network configuration. 5. The script executes `ip rule add from 10.100.0.2 table 51820`, changing the host policy-r ...[truncated 986 chars]
• Remediation: ## Remediation Suggestions - Remove automatic VPN and routing configuration from the transcript-fetching workflow. - Require administrators to provision and verify the VPN before invoking the skill. - If automatic setup is essential, require an explicit opt-in option such as `--configure-vpn`. - Run transcript retrieval as an unprivileged account without root access or `CAP_NET_ADMIN`. - Check and handle the return code and standard error of every subprocess. - Verify whether the interface and routing rule already exist before attempting changes. - Validate the active WireGuard configuration and restrict configuration-file ownership and permissions. - Perform network changes in an isolated network namespace or container rather than the host namespace. - Provide a cleanup procedure that removes only rules created by the current process.

T08 · Insecure Dependencies

Warning

• Location: references/SETUP.md:14
• Finding: Unpinned Third-Party Python Dependencies## Vulnerability Details **File Location**: `references/SETUP.md`, lines 14-18 **Vulnerability Type**: Mutable and unverified dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash ## 1. Install Python Dependencies ```bash pip3 install youtube-transcript-api requests ``` ``` ### Technical Analysis The setup instructions install dependencies from the package index without version constraints, integrity hashes, or a lock file. Each installation can therefore resolve a different package release from the one reviewed during the audit. Python packages can execute code during installation and are imported at runtime by the script. A compromised upstream release, compromised maintainer account, malicious transitive dependency, or unexpectedly incompatible future version could consequently introduce attacker-controlled code into the environment. The documented command also does not require an isolated virtual environment, potentially allowing dependency installation into a shared or privileged Python environment. ### Attack Path 1. An operator follows the documented setup instructions. 2. `pip3` queries its configured package index and resolves the latest available versions. 3. An upstream package, release artifact, or transitive dependency has been compromised or replaced with a malicious version. 4. The malicious package executes installation logic or is imported when `fetch_transcript.py` runs. 5. The package code receives the privileges and data access of the installing or executing account. No evidence indicates that either named package is currently malicious. This finding concerns the absence of controls needed to ensure that future installations use reviewed artifacts. ### Impact Assessment Successful supply-chain compromise could allow arbitrary Python code execution with the permissions of the installer or runtime account. If setup is performed as root or in a privileged system envir ...[truncated 206 chars]
• Remediation: ## Remediation Suggestions - Pin exact, reviewed versions of all direct and transitive dependencies. - Generate a lock file containing cryptographic hashes for every distribution artifact. - Install with hash verification, for example through `pip install --require-hashes -r requirements.txt`. - Use a dedicated virtual environment and avoid installing packages as root. - Review dependency provenance and monitor published security advisories. - Use a controlled internal package mirror where appropriate. - Add automated dependency scanning and controlled update review to the release process.

other

Warning

• Location: scripts/fetch_transcript.py:89
• Finding: Video Identifier and Source IP Disclosed to an Undocumented Third Party## Vulnerability Details **File Location**: `scripts/fetch_transcript.py`, lines 89-99 **Vulnerability Type**: Privacy-relevant third-party data disclosure and VPN bypass **Risk Level**: Medium ### Vulnerable Code ```python def get_video_title(video_id): """Get video title via oembed.""" try: resp = requests.get( f"https://noembed.com/embed?url=https://www.youtube.com/watch?v={video_id}", timeout=10 ) data = resp.json() return data.get("title", "Unknown"), data.get("author_name", "Unknown") except: return "Unknown", "Unknown" ``` ### Technical Analysis The function transmits every requested video identifier to `noembed.com` to retrieve metadata. Unlike transcript retrieval, this request uses the global `requests.get()` function rather than the source-IP-bound VPN session created in `fetch_transcript()`. As a result, the request normally leaves through the host's default network route and exposes both the host's direct source IP address and the requested YouTube video identifier to an additional third party. The project documentation describes routing transcript traffic through a residential VPN but does not identify this direct metadata recipient. TLS protects the request contents in transit from ordinary passive observers, but it does not prevent `noembed.com` from observing and logging the request. The broad exception handler also suppresses errors that might otherwise reveal metadata-service failures or routing problems. ### Attack Path 1. A user asks the skill to retrieve a transcript for a particular YouTube video. 2. The script extracts the video identifier and verifies or starts the VPN. 3. Before fetching the transcript, `get_video_title()` calls `https://noembed.com/embed`. 4. Because the request does not use the VPN-bound session, it follows the default route. 5. The third-party service receives the host source IP, r ...[truncated 763 chars]
• Remediation: ## Remediation Suggestions - Retrieve metadata through the same source-IP-bound `requests.Session` used for transcript requests. - Prefer a documented YouTube endpoint if doing so satisfies the functional requirements. - Make metadata retrieval optional and avoid contacting an extra service by default. - Clearly document every external service that receives user-supplied identifiers. - Obtain user consent before disclosing requested content identifiers to an additional provider. - Apply an explicit privacy policy and suitable retention requirements when using third-party metadata services. - Replace the bare `except` clause with narrowly scoped exception handling and appropriate diagnostics that do not expose sensitive data.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill advertises and instructs use of shell execution and outbound network access, but it does not declare any explicit tool scope or permissions boundaries. That increases the chance the agent can invoke the skill in environments where users and reviewers are unaware it will execute commands and make external requests, reducing oversight and consent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The invocation description is broad enough to match ordinary summarization or transcription requests, which can cause the skill to be selected even when a user did not ask to access YouTube or use proxy-backed network retrieval. In this skill's context, that broad trigger surface is more dangerous because activation may lead to shell execution and external routing through VPN/proxy infrastructure.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The description mentions transcript fetching but does not clearly warn users at invocation time that requests may be routed through a residential IP proxy or VPN to bypass YouTube cloud IP blocks. That is dangerous because it can cause users to unknowingly trigger traffic laundering, policy-sensitive evasion behavior, or third-party network usage they would not have consented to.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The setup guide instructs users to route traffic through a residential WireGuard endpoint and alter system routing, but it does not warn about the privacy, legal, and security implications of tunneling requests through a home network. This can expose a user's residential IP, broaden attack surface on the home network, and cause unintended traffic routing or policy violations if followed without understanding the risks.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The hard-coded LANGUAGES list limits processing to specific languages by default. Under the policy, forcing a language or locale constraint without explicit user choice or a documented, justified regional scope is a natural-language policy concern.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def check_vpn():
    """Check if WireGuard VPN is up and has recent handshake."""
    try:
        result = subprocess.run(
            ["wg", "show", VPN_INTERFACE],
            capture_output=True, text=True, timeout=5
        )

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill performs VPN and routing operations that are not intrinsic to transcript parsing and summarization, creating hidden host-level side effects for a seemingly simple content-access tool. The skill description explicitly says it uses a residential IP proxy to bypass YouTube cloud IP blocks, which makes this more dangerous in context because it is intentionally designed to evade platform network restrictions using privileged local reconfiguration.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

def bring_up_vpn():
    """Attempt to bring up VPN."""
    try:
        subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)
        subprocess.run(
            ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"],
            capture_output=True, timeout=5

• Confidence: 89% confidence
• Finding: This call attempts to bring up a WireGuard interface from within a transcript-fetching skill, causing a content-retrieval tool to execute privileged network-management actions on the host. In an agent/plugin context this is dangerous because using the skill can alter system networking, require elevated privileges, and create an unexpected path for traffic redirection or proxying beyond the stated user task.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"""Attempt to bring up VPN."""
    try:
        subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)
        subprocess.run(
            ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"],
            capture_output=True, timeout=5
        )

• Confidence: 91% confidence
• Finding: This subprocess modifies host routing policy by adding an IP rule, which is a privileged system-level change unrelated to merely reading a transcript. In a skill ecosystem this broadens impact substantially: repeated invocation can mutate network state, redirect traffic, bypass expected egress controls, and affect other processes on the machine.

Static analysis

No suspicious patterns detected.