Video to Text

• Outcome: Review
• Latest audit: Jun 18, 2026 · 6:34 PM UTC
• Version: 1.0.4

Overview

The skill appears to support media transcription/download workflows, but its transcription helper is reported to execute generated Python containing user-provided prompt text, which could let crafted input run arbitrary local code.

Review before installing. Use only if you trust the publisher and can inspect or patch the transcription helper so prompts are passed as data, not embedded in executable Python. Avoid enabling global yt-dlp configuration unless you want that cross-session behavior, and prefer skill-scoped settings where possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

print('---FULLTEXT---')
print(result['text'])
"""
    result = subprocess.run(
        ["python", "-c", python_code],
        capture_output=True, text=True, encoding='utf-8', errors='replace'
    )

• Confidence: 98% confidence
• Finding: The script builds Python source code with untrusted values interpolated into it and then executes it via `python -c`. A user-controlled `prompt` is inserted into a triple-quoted Python string without escaping, so crafted input can break out of the string and achieve arbitrary Python code execution in the spawned interpreter.

Tainted flow: 'python_code' from os.environ.get (line 61, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

print('---FULLTEXT---')
print(result['text'])
"""
    result = subprocess.run(
        ["python", "-c", python_code],
        capture_output=True, text=True, encoding='utf-8', errors='replace'
    )

• Confidence: 97% confidence
• Finding: This is a real code-execution issue, though the more direct taint source is CLI/user input (`prompt`) rather than the environment. Untrusted data is embedded into generated Python and executed with `python -c`, allowing an attacker to inject arbitrary Python statements and fully compromise the process context.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence
• Finding: The skill instructs use of shell commands, environment variables, and filesystem locations, but does not declare corresponding permissions. That creates a transparency and least-privilege problem: an agent or user may invoke capabilities with side effects on the host system without clear permission signaling.

Session Persistence

Medium

• Category: Rogue Agent

Content

### yt-dlp global config (optional)

```bash
# Windows: Create %APPDATA%\yt-dlp\config (one line):
-o X:\video_downloads\%(title)s.%(ext)s

# macOS/Linux: Create ~/.config/yt-dlp/config (one line):

• Confidence: 82% confidence
• Finding: The skill recommends creating persistent global yt-dlp configuration under user profile directories. Persistent configuration can alter future behavior outside this skill invocation, causing unintended downloads, file writes, or output-path changes across sessions and other workflows.

VirusTotal

59/59 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.