Trust Assessment
youtube received a trust score of 10/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 7 findings: 2 critical, 3 high, 1 medium, and 1 low severity. Key findings include Arbitrary command execution, Dangerous call: subprocess.run(), Broad YouTube API Scopes Requested.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The Manifest Analysis layer scored lowest at 40/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings7
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/globalcaos/youtube-ultimate/scripts/youtube.py:585 | |
| CRITICAL | Arbitrary command execution Python shell execution (os.system, subprocess) Review all shell execution calls. Ensure commands are static (not built from user input), use absolute paths, and are strictly necessary. Prefer library APIs over shell commands. | Manifest | skills/globalcaos/youtube-ultimate/scripts/youtube.py:609 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'cmd_download'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/globalcaos/youtube-ultimate/scripts/youtube.py:585 | |
| HIGH | Dangerous call: subprocess.run() Call to 'subprocess.run()' detected in function 'cmd_download_audio'. This can execute arbitrary code. Avoid using dangerous functions like exec/eval/os.system. Use safer alternatives. | Static | skills/globalcaos/youtube-ultimate/scripts/youtube.py:609 | |
| HIGH | Broad YouTube API Scopes Requested The skill requests the `https://www.googleapis.com/auth/youtube` scope, which grants full read/write access to the user's YouTube account, including managing videos, playlists, subscriptions, and comments. While some skill functions (e.g., `subscriptions`, `playlists`) require read access, the broad `youtube` scope is excessive for a skill primarily advertised for 'research,' 'transcripts,' and 'downloads.' This could allow a compromised skill or a malicious prompt to perform actions like deleting videos, uploading content, or modifying channel settings. The skill's manifest does not declare these scopes, but they are hardcoded in `scripts/youtube.py`. Reduce the requested YouTube API scopes to the minimum necessary for the skill's advertised functionality. For read-only operations, `https://www.googleapis.com/auth/youtube.readonly` is sufficient. If write operations are truly intended (e.g., managing user playlists), these should be explicitly documented and justified, and more granular scopes should be preferred if available. | LLM | scripts/youtube.py:40 | |
| MEDIUM | User-controlled output path for file downloads The `download` and `download-audio` commands allow the user to specify an arbitrary output path via the `-o` or `--output` argument. While `os.path.expanduser` is used, `yt-dlp` will attempt to write the downloaded file to the specified location. An attacker could craft a prompt that instructs the skill to download a file to a sensitive system location (e.g., `/etc/cron.d/`, `~/.ssh/authorized_keys`, or overwrite critical user files) if the user running the skill has write permissions to that location. This is a risk inherent to tools that allow arbitrary file writes based on user input. Implement stricter validation or sandboxing for the output path. Consider restricting downloads to a specific, isolated directory within the skill's workspace or a user-designated download folder, rather than allowing arbitrary paths. If arbitrary paths are necessary, clearly warn users about the risks and ensure the skill runs with minimal necessary file system permissions. | LLM | scripts/youtube.py:240 | |
| LOW | Use of `pickle` for storing authentication tokens The skill uses Python's `pickle` module to serialize and deserialize OAuth tokens to `token.pickle` files. Deserializing data from an untrusted source using `pickle.load()` can lead to arbitrary code execution. While the skill itself writes these files, an attacker who can replace or tamper with the `token.pickle` file (e.g., through local file system access or by exploiting another vulnerability) could potentially execute arbitrary code when the skill attempts to load the malicious pickle file. Consider using a more secure serialization format for sensitive data like authentication tokens, such as JSON (with proper encryption for sensitive fields) or a dedicated secure storage mechanism, which are less prone to arbitrary code execution vulnerabilities upon deserialization. | LLM | scripts/youtube.py:70 |
Scan History
Embed Code
[](https://skillshield.io/report/7c2682a33132bae4)
Powered by SkillShield