Security audit
Security checks for vulnerabilities and agentic risk
The skill’s YouTube search function is legitimate, but its setup flow handles account creation, verification codes, API keys, and persistent local credential storage in ways users should review carefully before installing.
Install only if you are comfortable with the agent helping create or use a YTAPI account, sending your email and verification code to YTAPI, and storing a long-lived API key for future sessions. Prefer creating the account yourself in the YTAPI web UI and providing a key only when needed, or ask the agent to keep the key session-only.
The skill instructs the agent to solicit highly sensitive credentials from the user: an API key or, alternatively, an email address plus a 6-digit verification code that can be used to create an account and obtain an API key. It then directs the agent to persist the resulting credential for future sessions, greatly expanding the blast radius if the agent logs, memory, prompts, or local storage are exposed.
The instructions explicitly save signup and verification responses containing a signup token and later an API key to predictable temporary files under /tmp, then reuse those artifacts to obtain and persist credentials. Temporary files in shared or multi-user environments can be exposed through weak permissions, backups, crash reports, or later compromise, making sensitive authentication material easier to steal.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
2. Check it in the current session without printing it, for example
`test -n "$YTAPI_API_KEY" && echo set`. If the session must be reloaded to
see it, reload it or tell the user.
3. Delete the temporary files: `rm -f /tmp/ytapi-signup.json /tmp/ytapi-verify.json`.
The user can sign in at https://ytapi.dev/auth/login?utm_source=skill with the same email to
see usage, manage keys and buy credits.
The manifest advertises a limited capability—searching YouTube and reading transcripts—but the documentation also authorizes creating a YTAPI account and key for the user. This mismatch is security-relevant because users and reviewers may not realize the skill can perform identity-linked third-party account provisioning and transmit personal data off-platform.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
homepage: https://ytapi.dev
requires:
bins:
- curl
primaryEnv: YTAPI_API_KEY
envVars:
- name: YTAPI_API_KEY
The skill expands beyond YouTube search/transcript retrieval by instructing the agent to create a third-party YTAPI account on the user's behalf when no API key is present. That introduces account creation, consent, and data-sharing behavior not clearly scoped in the skill's primary purpose, which can cause unauthorized use of the user's email and unexpected third-party registration.
The skill permits using the user's email to create a YTAPI account without an explicit privacy warning that the email will be transmitted to an external service. This creates a real privacy and consent risk because personally identifiable information is shared with a third party for a purpose not strictly necessary if the user could instead provide their own API key.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -G "https://api.ytapi.dev/v1/search" \
--data-urlencode "q=QUERY" -d type=video -d limit=20 \
-H "Authorization: Bearer $YTAPI_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s -G "https://api.ytapi.dev/v1/search" \
--data-urlencode "q=QUERY" -d type=video -d limit=20 \
-H "Authorization: Bearer $YTAPI_API_KEY"
The skill directs the agent to determine how to persist YTAPI_API_KEY across future sessions and store it in shell profiles, agent config, or a secrets store, but it does not require explicit user consent or warn that this changes local configuration and creates a long-lived credential on the machine. Persisting a secret beyond the immediate task increases exposure if the host is shared, later compromised, or if the agent chooses an insecure storage location.
The account-creation prompt asks the user for an email address and later a verification code to be sent to ytapi.dev, but it does not clearly disclose that these personal and authentication-related data will be transmitted to a third-party service. This undermines informed consent and can expose users to privacy risk or unintended sharing of identifiers and account-recovery material.
This step transmits the user's email address to an external service (https://ytapi.dev/api/agent/signup) to initiate account creation. While that is functionally required for signup, it is still a security and privacy concern because it shares user data off-platform without an explicit warning or consent flow in the skill itself.
to request in one step.
curl -s -X POST https://ytapi.dev/api/agent/signup \
-H "Content-Type: application/json" \
-d '{"email": "USER_EMAIL"}' \
-o /tmp/ytapi-signup.json
This step sends the signup token and user-provided verification code to an external verification endpoint, which is necessary for account creation but involves transmission of authentication material to a third-party service. If mishandled, intercepted, or logged, these values could be abused to complete account creation and mint an API key.
TOKEN=$(sed -n 's/.*"signup_token":"\([^"]*\)".*/\1/p' /tmp/ytapi-signup.json)
curl -s -X POST https://ytapi.dev/api/agent/verify \
-H "Content-Type: application/json" \
-d "{\"signup_token\": \"$TOKEN\", \"code\": \"CODE\"}" \
-o /tmp/ytapi-verify.json
The manifest description appends a Chinese sentence without explaining whether the skill is bilingual by default or user-selectable. This can be interpreted as a language/locale presentation choice that is not explicitly offered as an opt-in.
No suspicious patterns detected.