Agent Economy ReportAgent Economy ReportCAUTION version 1.0.0 · audited 2026-09-17
This package provides a small Python script that fetches video subtitles using yt-dlp. It accepts a URL, downloads English subtitles or auto-generated captions into a temporary folder, reads the first subtitle file, removes WebVTT formatting, and prints plain text. The printed transcript is intended for an agent to read and summarize or answer questions from. The code does not collect credentials, handle payments, install persistence, or contain hidden network destinations. The main cautions are that it accepts any URL without a YouTube-only check, and the transcript text comes from an outside source that could contain misleading instructions.
Instructions try to steer the agent beyond the declared purpose. scripts/get_transcript.py line 71 prints cleaned transcript text, and SKILL.md line 37 tells the agent to read that output and summarize it. YouTube subtitles are authored by the video uploader, so the text could be crafted to manipulate an agent that treats it as instructions.
| Declared purpose | Fetch and read transcripts from YouTube videos. Use when you need to summarize a video, answer questions about its content, or extract information from it. |
| Observed behavior | The skill documents running scripts/get_transcript.py with a video URL. The script accepts a URL, builds a yt-dlp command to download English subtitles and auto-subs into a temporary directory, reads the first .vtt file, strips WebVTT formatting and timestamps, and prints plain text to stdout. No credentials, wallet, persistence, or hidden network destinations are present. |
| Verdict, rules only | CAUTION · runs subprocesses or eval/exec |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| network | needed | yt-dlp makes outbound requests to the given URL; scripts/get_transcript.py lines 42-48 build and run the command. |
| shell | needed | The skill is invoked through a bash/python3 command in SKILL.md line 26, and the script runs yt-dlp via subprocess.run at scripts/get_transcript.py line 52. It does not use shell=True. |
| filesystem_read | needed | Reads a downloaded .vtt subtitle file from a temporary directory at scripts/get_transcript.py lines 60-69. |
| filesystem_write | needed | yt-dlp writes subtitle files into a temporary directory through --write-subs/--write-auto-subs and --output at scripts/get_transcript.py lines 43-47. |
| install_packages | needed | Metadata install steps install yt-dlp via brew or pip at SKILL.md line 12. |
| severity | finding |
|---|---|
| info | Declares installation of yt-dlp The metadata tells the platform it can install yt-dlp via Homebrew or pip. Installing a third-party package is expected for the skill, but the source should be trusted and preferably pinned. SKILL.md:12 "install":[{"id":"brew","kind":"brew","formula":"yt-dlp","bins":["yt-dlp"],"label":"Install yt-dlp (brew)"},{"id":"pip","kind":"pip","package":"yt-dlp","bins":[ |
| info | Uses yt-dlp for network retrieval The script builds a command around yt-dlp. Network requests are made by yt-dlp when it processes the supplied URL. scripts/get_transcript.py:42 "yt-dlp", |
| medium | Accepts arbitrary URL without allowlist The help text says YouTube URL, but there is no host validation before the URL is passed to yt-dlp. An agent could be induced to pass a non-YouTube URL and cause outbound network access to other hosts. scripts/get_transcript.py:75 parser.add_argument("url", help="YouTube video URL") |
| info | Subprocess call is not a shell The command is passed as a list and shell is not enabled, reducing the risk of shell injection from the URL. scripts/get_transcript.py:52 subprocess.run(cmd, cwd=temp_dir, check=True, capture_output=True) |
| info | Writes temporary subtitle files yt-dlp writes subtitle files inside a tempfile.TemporaryDirectory. The directory is deleted when the block exits, so this is not persistence. scripts/get_transcript.py:47 "--output", "subs" |
| info | Prints cleaned transcript to stdout The fetched text is emitted for the agent to use. This is the main data path for the prompt-injection concern. scripts/get_transcript.py:71 print(clean_text) |
| medium | Agent instructed to consume downloaded transcript Transcript text comes from the video's subtitles and is therefore untrusted. A malicious video uploader could place instruction-like text in subtitles that the agent may then read and summarize. SKILL.md:37 2. Read the output and summarize it for the user. |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawhub.ai | not in the service index | skill-card.md:9 |
| www.youtube.com | not in the service index | SKILL.md:26 |
| Binaries invoked | bash, pip, python3 |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 3 |
| base64 blobs | 0 |
| File writes | 1 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
SKILL.md | 48 | 89b97c95ce71f719… |
_meta.json | 6 | 89149d99986e839e… |
scripts/get_transcript.py | 81 | cebc75a5500cf26a… |
skill-card.md | 57 | a7150176cde7be5f… |
For agents
JSON: https://agenteconomy.report/k/youtube-watcher.audit.json · badge: https://agenteconomy.report/k/youtube-watcher.audited.svg ·
skill rating: /k/youtube-watcher · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).