Security audit
Security checks for vulnerabilities and agentic risk
The skill is mostly coherent for YouTube summarization, but its setup gives the agent broad account-creation and persistent credential-handling authority that users should review carefully.
Install only if you are comfortable with an agent-mediated YTAPI setup. Prefer creating your own YTAPI account and key directly on the provider site, then store the key in a trusted secret manager instead of pasting it or verification codes into chat or letting the agent modify persistent shell or agent configuration.
The skill states that if no API key is present, it can create a free account using the user's email, but this data-sharing behavior is not clearly disclosed in the top-level description. That creates a privacy and consent risk because personally identifiable information may be transmitted to a third-party service without sufficiently explicit user awareness at invocation time.
These instructions tell the agent to discover how the host persists environment variables across sessions, including non-interactive shells, and then modify that persistence layer. This is dangerous because it pushes the agent into host-level secret persistence and configuration changes that may affect other tools, users, or future sessions beyond the user’s immediate request.
The skill asks users to paste an API key or later provide an email verification code in plain conversation, which exposes sensitive authentication material to the chat system, logs, and any downstream tooling. Persisting the resulting API key for future sessions compounds the risk by turning transient disclosure into durable compromise.
The skill directs the agent to create an external service account using the user’s email and verification code, which is a significant action unrelated to mere content summarization. Handling email-based sign-up and verification codes in-chat gives the agent control over account lifecycle actions and increases the chance of privacy violations, phishing-like flows, or unauthorized service enrollment.
The instructions save signup and verification responses containing tokens and possibly API keys to local temporary files for later extraction. Local files can be read by other processes, persist longer than intended, end up in backups, or be exposed through debugging and tooling, making sensitive token handling unsafe.
The skill explicitly instructs the agent to store the API key so it remains available across future sessions without further user action. Long-lived cross-session credential persistence substantially increases blast radius if the agent environment is later compromised or if access controls differ between sessions.
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
2. Check it in the current session without printing it, for example
`test -n "$YTAPI_API_KEY" && echo set`. If the session must be reloaded to
see it, reload it or tell the user.
3. Delete the temporary files: `rm -f /tmp/ytapi-signup.json /tmp/ytapi-verify.json`.
The user can sign in at https://ytapi.dev/auth/login?utm_source=skill with the same email to
see usage, manage keys and buy credits.
The description says to use the skill when a user shares a YouTube link and asks 'what it says,' wants a 'TL;DR,' 'notes,' 'key takeaways' or a 'digest.' These are broad everyday phrases, and the manifest does not provide explicit boundaries or negative examples to distinguish YouTube-specific use from general summarization requests.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Details (free): title, channel, length, caption languages.
curl -s "https://api.ytapi.dev/v1/videos/VIDEO_ID/basic-info" -H "Authorization: Bearer $YTAPI_API_KEY"
Transcript with timestamps (1 credit). Save it to a file; long videos
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Details (free): title, channel, length, caption languages.
curl -s "https://api.ytapi.dev/v1/videos/VIDEO_ID/basic-info" -H "Authorization: Bearer $YTAPI_API_KEY"
Transcript with timestamps (1 credit). Save it to a file; long videos
The file instructs persistent storage of a secret for future sessions without clearly warning that this may alter shell profiles, agent configuration, or other persistence layers on the host. Secret persistence without explicit informed consent can create long-lived exposure and hidden state that the user may not expect or be able to audit.
The account-creation flow collects the user’s email and sends it to a third-party service without an explicit privacy disclosure, retention notice, or consent framing. Even if operationally necessary, transmitting personal data off-platform without clear notice can violate user expectations and organizational privacy requirements.
The skill goes beyond summarizing YouTube content and instructs the agent to create third-party accounts and retain credentials for later use. That expands the agent’s authority from task execution into identity and secret-management actions, creating a clear risk of unauthorized account creation, persistent access, and misuse of user credentials.
This command transmits the user’s email address to an external service, which is an outbound data flow to a third party. In context, the transmission is functionally related to signup, but it still creates privacy and compliance risk because it occurs through the agent workflow rather than a direct user-controlled interaction.
to request in one step.
curl -s -X POST https://ytapi.dev/api/agent/signup \
-H "Content-Type: application/json" \
-d '{"email": "USER_EMAIL"}' \
-o /tmp/ytapi-signup.json
This request sends a signup token and user-provided verification code to an external service, meaning the agent is actively brokering sensitive authentication material. Even if intended for account verification, routing these values through agent-controlled commands and files increases the chance of logging, leakage, or replay.
TOKEN=$(sed -n 's/.*"signup_token":"\([^"]*\)".*/\1/p' /tmp/ytapi-signup.json)
curl -s -X POST https://ytapi.dev/api/agent/verify \
-H "Content-Type: application/json" \
-d "{\"signup_token\": \"$TOKEN\", \"code\": \"CODE\"}" \
-o /tmp/ytapi-verify.json
No suspicious patterns detected.