ClawHub
Back to skill

Security audit

YouTube ASR Summarize (Local)

Security checks for vulnerabilities and agentic risk

Overview

This skill performs a disclosed YouTube download/transcription workflow with local outputs; the main issues are setup and privacy cautions, not hidden malicious behavior.

Install only in a dedicated virtual environment, review the unpinned faster-whisper dependency before use, set the language option deliberately, and inspect any extracted frames before sharing them because screenshots may contain sensitive or copyrighted visual content.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:23
Finding

Unpinned Third-Party Dependency Installation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:23
Additional Location: references/workflow.md:9
Vulnerability Type: Unpinned dependency installation without integrity verification
Risk Level: Medium

Vulnerable Code

SKILL.md:23:

bash
pip install faster-whisper

references/workflow.md:9:

bash
python3 -m venv .venv && source .venv/bin/activate && pip install faster-whisper

Technical Analysis

The documented setup procedures install faster-whisper and its transitive dependencies from the user's configured Python package index without pinning versions or verifying package hashes. The project does not provide a lockfile, hash-locked requirements file, or trusted-index restriction.

Consequently, the code that users install can differ from the code reviewed during this audit. A compromised package-index account, malicious future package release, dependency-confusion condition involving a transitive dependency, or compromised configured package mirror could introduce attacker-controlled code. Such code may execute during package installation or when faster_whisper is imported by scripts/youtube_asr_summarize.py.

This finding identifies a supply-chain exposure; the reviewed project does not itself contain evidence that the current faster-whisper package is malicious.

Attack Path

  1. An attacker compromises a relevant package publication account, package index, configured mirror, or dependency-resolution path.
  2. The attacker publishes a malicious release of faster-whisper or one of its transitive dependencies.
  3. A user follows the project documentation and runs the unpinned pip install faster-whisper command.
  4. Pip resolves and installs the attacker-controlled release because no reviewed version or cryptographic hash is required.
  5. Malicious code executes during installation or when the script imports faster_whisper.
  6. The payload acts with the operating-system privileges and filesystem/netwo ...[truncated 665 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin faster-whisper and every transitive dependency to versions that have been reviewed and tested.
  2. Generate a hash-locked dependency file, for example with pip-compile --generate-hashes.
  3. Install dependencies using hash enforcement:
bash
python3 -m pip install --require-hashes -r requirements.txt
  1. Commit the reviewed requirements or lock file to the project and update both setup documents to reference it instead of installing an unconstrained package.
  2. Use python3 -m pip rather than a bare pip command to ensure installation into the intended interpreter environment.
  3. Document the expected trusted package index and avoid untrusted or unintended extra indexes.
  4. Automate dependency vulnerability and integrity review when updating pinned versions.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The documented purpose says the skill is for videos with no subtitles and local ASR, but the broader behavior reportedly also uses existing subtitles or auto-subs when available. This mismatch can cause agents and users to invoke the skill under incorrect assumptions about data sources, privacy properties, and when downloading or processing should occur.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill invokes shell commands and performs file read/write operations, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization gap where an agent may execute broader local actions than reviewers or policy systems expect, increasing the chance of unintended command execution or filesystem access.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example invocation hardcodes --lang zh, which can force Chinese transcription without user choice. While not a direct code-execution issue, it can lead to incorrect processing of user content, inaccurate summaries, and handling of language-sensitive data in a way the user did not request.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The workflow explicitly instructs the operator to attach extracted video frames to the final deliverable, but it provides no privacy or sensitivity check before sharing those images. Screenshots can capture faces, minors, medical details, addresses, screens, or other sensitive visual content from the source video, so this can cause unintended disclosure even when the textual summary would have been safe to share.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/youtube_asr_summarize.py (reported line 38)May include surrounding context.

python
def run(cmd: list[str], cwd: Path | None = None):
    p = subprocess.run(cmd, cwd=str(cwd) if cwd else None, stdout=subprocess.PIPE, stderr=subprocess.STDOUT, text=True)
    if p.returncode != 0:
        raise RuntimeError(f"Command failed ({p.returncode}): {' '.join(cmd)}\n{p.stdout[-4000:]}")
    return p.stdout

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The script sets --lang to zh by default, and the summarization/output text is hard-coded in Chinese elsewhere, effectively forcing a specific language/locale unless the user overrides it. This matches the policy category for language or locale constraints without explicit user opt-in.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest frames this skill as summarizing videos with no subtitles by doing local ASR. In contrast, the implementation first fetches human and auto-generated subtitles via yt-dlp and uses them directly when available, so the primary behavior is broader than the stated 'no subtitles' ASR-only scenario.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The docstring's statement is phrased as an intent/safety claim about content handling. While the code does not appear to upload user-generated content, it does transmit requests to remote services to fetch metadata and media, so the wording can mislead readers into thinking the tool is fully local apart from local ASR.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.