ClawHub
Back to skill

Security audit

YouTube Transcript

Security checks for vulnerabilities and agentic risk

Overview

This YouTube transcript skill is mostly transparent about its purpose, but it can change host VPN/routing settings and contact an extra metadata service, so it should be reviewed before use.

Install only if you intentionally want transcript requests routed through a residential VPN/proxy and you are comfortable with host-level WireGuard and routing changes. Prefer running it as an unprivileged user in an isolated environment, preconfigure networking outside the skill, pin dependencies, and treat noembed.com as an additional party that can see requested video IDs.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/fetch_transcript.py:45
Finding

Automatic Privileged Host Network Modification

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch_transcript.py, lines 45-56
Vulnerability Type: Automatic execution of privileged network-management commands
Risk Level: High

Vulnerable Code

python
def bring_up_vpn():
    """Attempt to bring up VPN."""
    try:
        subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)
        subprocess.run(
            ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"],
            capture_output=True, timeout=5
        )
        return check_vpn()
    except Exception as e:
        return False, str(e)

Technical Analysis

When the expected VPN is unavailable, the script automatically invokes wg-quick and modifies the host policy-routing table. These operations affect system-wide networking and ordinarily require root privileges or the CAP_NET_ADMIN capability.

Fixed argument arrays are used rather than a shell command, so no command-injection path was identified. However, invoking wg-quick up wg0 causes the host to process the existing WireGuard configuration for wg0, which may include routing changes or configuration hooks. The operation therefore exceeds the minimum privileges required merely to retrieve a transcript.

The script also ignores the return codes from both commands. Consequently, it cannot reliably distinguish successful configuration from partial failure. Repeated executions can attempt to add the same policy-routing rule multiple times.

Attack Path

  1. The script is run by an agent or service account with root privileges or network-administration capabilities.
  2. check_vpn() reports that wg0 is unavailable or lacks a handshake.
  3. The script automatically executes wg-quick up wg0.
  4. The host processes /etc/wireguard/wg0.conf and applies its network configuration.
  5. The script executes ip rule add from 10.100.0.2 table 51820, changing the host policy-r ...[truncated 986 chars]
Remediation
View remediation

Remediation Suggestions

  • Remove automatic VPN and routing configuration from the transcript-fetching workflow.
  • Require administrators to provision and verify the VPN before invoking the skill.
  • If automatic setup is essential, require an explicit opt-in option such as --configure-vpn.
  • Run transcript retrieval as an unprivileged account without root access or CAP_NET_ADMIN.
  • Check and handle the return code and standard error of every subprocess.
  • Verify whether the interface and routing rule already exist before attempting changes.
  • Validate the active WireGuard configuration and restrict configuration-file ownership and permissions.
  • Perform network changes in an isolated network namespace or container rather than the host namespace.
  • Provide a cleanup procedure that removes only rules created by the current process.

T08 · Insecure Dependencies

Warning
Location
references/SETUP.md:14
Finding

Unpinned Third-Party Python Dependencies

Content
View full analysis

Vulnerability Details

File Location: references/SETUP.md, lines 14-18
Vulnerability Type: Mutable and unverified dependency installation
Risk Level: Medium

Vulnerable Code

bash
## 1. Install Python Dependencies

```bash
pip3 install youtube-transcript-api requests
text

### Technical Analysis

The setup instructions install dependencies from the package index without version constraints, integrity hashes, or a lock file. Each installation can therefore resolve a different package release from the one reviewed during the audit.

Python packages can execute code during installation and are imported at runtime by the script. A compromised upstream release, compromised maintainer account, malicious transitive dependency, or unexpectedly incompatible future version could consequently introduce attacker-controlled code into the environment.

The documented command also does not require an isolated virtual environment, potentially allowing dependency installation into a shared or privileged Python environment.

### Attack Path

1. An operator follows the documented setup instructions.
2. `pip3` queries its configured package index and resolves the latest available versions.
3. An upstream package, release artifact, or transitive dependency has been compromised or replaced with a malicious version.
4. The malicious package executes installation logic or is imported when `fetch_transcript.py` runs.
5. The package code receives the privileges and data access of the installing or executing account.

No evidence indicates that either named package is currently malicious. This finding concerns the absence of controls needed to ensure that future installations use reviewed artifacts.

### Impact Assessment

Successful supply-chain compromise could allow arbitrary Python code execution with the permissions of the installer or runtime account. If setup is performed as root or in a privileged system envir
...[truncated 206 chars]
Remediation
View remediation

Remediation Suggestions

  • Pin exact, reviewed versions of all direct and transitive dependencies.
  • Generate a lock file containing cryptographic hashes for every distribution artifact.
  • Install with hash verification, for example through pip install --require-hashes -r requirements.txt.
  • Use a dedicated virtual environment and avoid installing packages as root.
  • Review dependency provenance and monitor published security advisories.
  • Use a controlled internal package mirror where appropriate.
  • Add automated dependency scanning and controlled update review to the release process.

other

Warning
Location
scripts/fetch_transcript.py:89
Finding

Video Identifier and Source IP Disclosed to an Undocumented Third Party

Content
View full analysis

Vulnerability Details

File Location: scripts/fetch_transcript.py, lines 89-99
Vulnerability Type: Privacy-relevant third-party data disclosure and VPN bypass
Risk Level: Medium

Vulnerable Code

python
def get_video_title(video_id):
    """Get video title via oembed."""
    try:
        resp = requests.get(
            f"https://noembed.com/embed?url=https://www.youtube.com/watch?v={video_id}",
            timeout=10
        )
        data = resp.json()
        return data.get("title", "Unknown"), data.get("author_name", "Unknown")
    except:
        return "Unknown", "Unknown"

Technical Analysis

The function transmits every requested video identifier to noembed.com to retrieve metadata. Unlike transcript retrieval, this request uses the global requests.get() function rather than the source-IP-bound VPN session created in fetch_transcript().

As a result, the request normally leaves through the host's default network route and exposes both the host's direct source IP address and the requested YouTube video identifier to an additional third party. The project documentation describes routing transcript traffic through a residential VPN but does not identify this direct metadata recipient.

TLS protects the request contents in transit from ordinary passive observers, but it does not prevent noembed.com from observing and logging the request. The broad exception handler also suppresses errors that might otherwise reveal metadata-service failures or routing problems.

Attack Path

  1. A user asks the skill to retrieve a transcript for a particular YouTube video.
  2. The script extracts the video identifier and verifies or starts the VPN.
  3. Before fetching the transcript, get_video_title() calls https://noembed.com/embed.
  4. Because the request does not use the VPN-bound session, it follows the default route.
  5. The third-party service receives the host source IP, r ...[truncated 763 chars]
Remediation
View remediation

Remediation Suggestions

  • Retrieve metadata through the same source-IP-bound requests.Session used for transcript requests.
  • Prefer a documented YouTube endpoint if doing so satisfies the functional requirements.
  • Make metadata retrieval optional and avoid contacting an extra service by default.
  • Clearly document every external service that receives user-supplied identifiers.
  • Obtain user consent before disclosing requested content identifiers to an additional provider.
  • Apply an explicit privacy policy and suitable retention requirements when using third-party metadata services.
  • Replace the bare except clause with narrowly scoped exception handling and appropriate diagnostics that do not expose sensitive data.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill advertises and instructs use of shell execution and outbound network access, but it does not declare any explicit tool scope or permissions boundaries. That increases the chance the agent can invoke the skill in environments where users and reviewers are unaware it will execute commands and make external requests, reducing oversight and consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The invocation description is broad enough to match ordinary summarization or transcription requests, which can cause the skill to be selected even when a user did not ask to access YouTube or use proxy-backed network retrieval. In this skill's context, that broad trigger surface is more dangerous because activation may lead to shell execution and external routing through VPN/proxy infrastructure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The description mentions transcript fetching but does not clearly warn users at invocation time that requests may be routed through a residential IP proxy or VPN to bypass YouTube cloud IP blocks. That is dangerous because it can cause users to unknowingly trigger traffic laundering, policy-sensitive evasion behavior, or third-party network usage they would not have consented to.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup guide instructs users to route traffic through a residential WireGuard endpoint and alter system routing, but it does not warn about the privacy, legal, and security implications of tunneling requests through a home network. This can expose a user's residential IP, broaden attack surface on the home network, and cause unintended traffic routing or policy violations if followed without understanding the risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

The hard-coded LANGUAGES list limits processing to specific languages by default. Under the policy, forcing a language or locale constraint without explicit user choice or a documented, justified regional scope is a natural-language policy concern.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_transcript.py (reported line 32)May include surrounding context.

python
def check_vpn():
    """Check if WireGuard VPN is up and has recent handshake."""
    try:
        result = subprocess.run(
            ["wg", "show", VPN_INTERFACE],
            capture_output=True, text=True, timeout=5
        )

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill performs VPN and routing operations that are not intrinsic to transcript parsing and summarization, creating hidden host-level side effects for a seemingly simple content-access tool. The skill description explicitly says it uses a residential IP proxy to bypass YouTube cloud IP blocks, which makes this more dangerous in context because it is intentionally designed to evade platform network restrictions using privileged local reconfiguration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
89% confidence
Finding

This call attempts to bring up a WireGuard interface from within a transcript-fetching skill, causing a content-retrieval tool to execute privileged network-management actions on the host. In an agent/plugin context this is dangerous because using the skill can alter system networking, require elevated privileges, and create an unexpected path for traffic redirection or proxying beyond the stated user task.

Content

Scanner excerpt · scripts/fetch_transcript.py (reported line 48)May include surrounding context.

python
def bring_up_vpn():
    """Attempt to bring up VPN."""
    try:
        subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)
        subprocess.run(
            ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"],
            capture_output=True, timeout=5

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
91% confidence
Finding

This subprocess modifies host routing policy by adding an IP rule, which is a privileged system-level change unrelated to merely reading a transcript. In a skill ecosystem this broadens impact substantially: repeated invocation can mutate network state, redirect traffic, bypass expected egress controls, and affect other processes on the machine.

Content

Scanner excerpt · scripts/fetch_transcript.py (reported line 49)May include surrounding context.

python
"""Attempt to bring up VPN."""
    try:
        subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)
        subprocess.run(
            ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"],
            capture_output=True, timeout=5
        )

Static analysis

No suspicious patterns detected.