{
  "skill_name": "video-transcript",
  "skill_path": "./skills/clawhub-video-transcript",
  "skill_directory": "./skills/clawhub-video-transcript",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_video-transcript_0",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Hardcoded API Key Requirement Without Validation",
      "description": "The skill requires users to store a TRANSCRIPT_API_KEY in their shell environment (~/.zshenv) but provides no validation, sanitization, or security guidance. Users are instructed to echo their API key directly into shell configuration files, which could expose credentials if the file has incorrect permissions or is accidentally committed to version control.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "Store: `echo 'export TRANSCRIPT_API_KEY=\"sk_...\"' >> ~/.zshenv && source ~/.zshenv`",
      "remediation": "Provide security guidance: (1) Verify file permissions (chmod 600 ~/.zshenv), (2) Warn against committing credentials to git, (3) Suggest using a secrets manager or encrypted credential store, (4) Add validation to check if the key format is correct before making API calls.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill provides legitimate functionality for extracting video transcripts via an external API service. The primary security concerns are around credential management (API key storage in shell config without security guidance) and data privacy (sending video URLs to third-party service without user consent or disclosure). The skill does not contain malicious code, prompt injection attempts, or data exfiltration patterns. However, it lacks important security best practices around credential handling and privacy transparency. The missing metadata fields and referenced file are minor documentation issues. Overall risk level is MODERATE - the skill is functional and non-malicious, but needs security and privacy improvements.",
        "primary_threats": [
          "Credential exposure risk (insecure API key storage guidance)",
          "Data privacy concerns (external API transmission without disclosure)",
          "Missing security metadata (no allowed-tools, license, compatibility)"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The current guidance lacks basic security practices for credential storage. While not actively malicious, it creates unnecessary risk for users unfamiliar with secure credential management.",
        "meta_exploitability": "Medium - requires user error (wrong permissions, git commit)",
        "meta_impact": "Medium - API key exposure could lead to quota theft or service abuse"
      }
    },
    {
      "id": "llm_finding_video-transcript_1",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "External API Data Transmission Without User Consent",
      "description": "The skill sends user-provided video URLs to an external third-party API (transcriptapi.com) without explicit user consent or privacy disclosure. Video URLs may contain sensitive information (unlisted videos, private shares, user viewing history). The skill does not disclose what data TranscriptAPI.com collects, logs, or retains.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "curl -s \"https://transcriptapi.com/api/v2/youtube/transcript?video_url=VIDEO_URL...\" -H \"Authorization: Bearer $TRANSCRIPT_API_KEY\"",
      "remediation": "Add privacy disclosure: (1) Inform users that video URLs are sent to transcriptapi.com, (2) Link to TranscriptAPI's privacy policy, (3) Warn about sharing unlisted/private video URLs, (4) Consider adding a confirmation prompt before sending data to external services.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill provides legitimate functionality for extracting video transcripts via an external API service. The primary security concerns are around credential management (API key storage in shell config without security guidance) and data privacy (sending video URLs to third-party service without user consent or disclosure). The skill does not contain malicious code, prompt injection attempts, or data exfiltration patterns. However, it lacks important security best practices around credential handling and privacy transparency. The missing metadata fields and referenced file are minor documentation issues. Overall risk level is MODERATE - the skill is functional and non-malicious, but needs security and privacy improvements.",
        "primary_threats": [
          "Credential exposure risk (insecure API key storage guidance)",
          "Data privacy concerns (external API transmission without disclosure)",
          "Missing security metadata (no allowed-tools, license, compatibility)"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "LLM analyzer correctly identified that video URLs are transmitted to external API without privacy disclosure. This is a legitimate privacy concern for unlisted/private videos.",
        "meta_exploitability": "Easy - automatic on skill use",
        "meta_impact": "Medium - privacy exposure of video viewing patterns, potential leak of unlisted video URLs"
      }
    }
  ],
  "scan_duration_seconds": 28.95065426826477,
  "duration_ms": 28950,
  "analyzers_used": [
    "static_analyzer",
    "behavioral_analyzer",
    "llm_analyzer",
    "trigger_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-01T08:54:06.007544"
}