Trust Assessment
youtube-transcript received a trust score of 44/100, placing it in the Untrusted category. This skill has significant security findings that require attention before use in production.
SkillShield's automated analysis identified 6 findings: 0 critical, 3 high, 2 medium, and 1 low severity. Key findings include Hardcoded Bearer Token detected, Potential Command Injection via `cat >>`, Excessive File System Write Permissions for Sub-Agent.
The analysis covered 4 layers: Manifest Analysis, Static Code Analysis, Dependency Graph, LLM Behavioral Safety. The LLM Behavioral Safety layer scored lowest at 69/100, indicating areas for improvement.
Last analyzed on February 13, 2026 (commit 13146e6a). SkillShield performs automated 4-layer security analysis on AI skills and MCP servers.
Layer Breakdown
Behavioral Risk Signals
Security Findings6
| Severity | Finding | Layer | Location | |
|---|---|---|---|---|
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/qingliu1617-art/ytb-transcript-long/SKILL.md:18 | |
| HIGH | Hardcoded Bearer Token detected A hardcoded Bearer Token was found. Secrets should be stored in environment variables or a secret manager. Replace the hardcoded secret with an environment variable reference. | Static | skills/qingliu1617-art/ytb-transcript-long/SKILL.md:22 | |
| HIGH | Potential Command Injection via `cat >>` The skill explicitly instructs the sub-agent to use the `cat >>` shell command for appending content to files. If the filename or the content being appended is derived from untrusted input (e.g., user-provided video titles, dynamic content), this could lead to arbitrary file writes, overwriting critical system files, or even remote code execution if combined with other vulnerabilities. Replace direct shell command `cat >>` with a secure file I/O method provided by the agent's runtime environment. If shell execution is strictly necessary, ensure all arguments derived from untrusted sources are rigorously validated and sanitized (e.g., using `shlex.quote` in Python or equivalent) before execution. Prefer using an agent's native file writing capabilities within a sandboxed environment. | LLM | SKILL.md:64 | |
| MEDIUM | Excessive File System Write Permissions for Sub-Agent The sub-agent is instructed to 'Process in 500-line chunks to separate files (part1.md, etc.). Merge to full_transcript.md.' and to 'Write each chunk to separate files'. This implies broad file system write access without specifying a confined, temporary directory. Without proper sandboxing, the sub-agent could write to arbitrary locations on the file system, potentially leading to data corruption or denial of service. Ensure sub-agents operate within a strictly sandboxed environment with limited file system access, ideally restricted to a temporary, isolated working directory. All file paths should be constructed internally by the agent and not directly from untrusted input. Implement explicit directory restrictions for all file write operations. | LLM | SKILL.md:53 | |
| MEDIUM | Unspecified/Unpinned External Tool Dependency (`zhiyan`) The skill mentions an optional external tool, `zhiyan`, for online document generation. However, no specific version, source, or installation method is provided. This introduces a supply chain risk, as an unpinned or ambiguously sourced dependency could lead to the installation of a malicious or vulnerable version of the tool, compromising the agent's environment. Specify the exact version and source of the `zhiyan` tool. If it's a custom tool, include its source code or a link to a version-controlled repository. If it's a public package, pin its version to prevent unexpected changes or malicious updates. Provide clear instructions for secure installation and verification. | LLM | SKILL.md:8 | |
| LOW | Sample Credential Pattern in Documentation The documentation includes a sample API key (`AIzaM9ifctIOxusNAldvGeajHqq4rH6e7MJNfN`) that closely resembles a real Google API key format. While this is a sample, using realistic-looking credentials in documentation can inadvertently encourage developers to use real keys in public contexts or lead to confusion, increasing the risk of accidental credential exposure. Replace the sample API key with a clearly fictitious placeholder (e.g., `YOUR_DOWNSUB_API_KEY_HERE`, `sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx`, or `SAMPLE_API_KEY`) to prevent any potential for accidental exposure of real credentials or misinterpretation. | LLM | SKILL.md:17 |
Scan History
Embed Code
[](https://skillshield.io/report/46684c5473473b57)
Powered by SkillShield