youtube-voice-summarizer
3 findings (1 high, 2 medium), mainly data exfiltration, social engineering, resource abuse. Most recent scan 2026-02-07.
This skill presents MODERATE to HIGH security risks primarily due to its dependency on an external, unverified GitHub repository that users must clone and execute locally. The skill requires users to run a Node.js backend service with three API keys stored in plaintext, creating credential exposure risks. The hardcoded localhost dependency (port 3050) could be exploited through port hijacking attacks. Additionally, the polling mechanism lacks timeout controls, potentially causing infinite loops. The manifest is misleading by not declaring required Bash tool access. While the skill's core functionality (YouTube summarization) is legitimate, the implementation introduces supply chain risks, credential management issues, and availability concerns that should be addressed before deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Transform YouTube videos into podcast-style voice summaries using ElevenLabs TTS
- Package
- 3 files, 6.9 KB
- SKILL.md
- 471 words, 12+ sections
- Code
- None. Instructions only.
- License
- MIT
- Version
- 1.0.0
SKILL.md covers: YouTube Voice Summarizer · What It Does · Requirements · Add your API keys to .env · Required API Keys · How to Use · Step 1: Start the voice summary job · Step 2: Poll for completion (wait 3-5 seconds between checks) · Step 3: Return the audio to user · Voice Options · Summary Lengths · Example Flow
Findings
HIGH Hardcoded Localhost Backend Dependency with Unverified External Service Data Exfiltrationllm
The skill requires users to deploy and run a backend server from an external GitHub repository (https://github.com/Franciscomoney/elevenlabs-moltbot.git) on localhost:3050. This creates multiple security risks: (1) Users must clone and execute code from an external, unverified source, (2) The skill makes network calls to localhost:3050 which could be hijacked if malicious software binds to that port first, (3) No integrity verification (checksums, signatures) for the cloned repository, (4) The backend server requires three API keys (ElevenLabs, Supadata, OpenRouter) stored in .env file with no guidance on secure storage.
SKILL.md
```bash
git clone https://github.com/Franciscomoney/elevenlabs-moltbot.git
cd elevenlabs-moltbot
npm install
cp .env.example .env
# Add your API keys to .env
npm start
```MEDIUM Misleading Compatibility and Tool Requirements Social Engineeringllm
The skill manifest claims 'compatibility: Not specified' and 'allowed-tools: Not specified', but the skill fundamentally requires Bash tool access to execute curl commands. The skill cannot function without Bash capability, yet this critical requirement is not declared in the manifest. This is misleading to users and agents about the skill's actual requirements and capabilities.
SKILL.md
YAML Manifest shows:
- compatibility: Not specified
- allowed-tools: Not specified
But instructions require: `curl -s -X POST http://127.0.0.1:3050/api/summarize` (Bash tool required)MEDIUM Potential Infinite Polling Loop Without Timeout Resource Abusellm
The instructions direct the agent to 'Keep polling until status is completed' with 3-5 second intervals, but provide no maximum retry limit or timeout. If the backend service fails, hangs, or returns perpetual 'processing' status, the agent could enter an infinite loop consuming resources indefinitely.
SKILL.md
Step 2 instructions: "Poll for completion (wait 3-5 seconds between checks)" followed by "Keep polling until status is 'completed'" with no termination condition if the job never completes.What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 1.0 KB |
SKILL.md | doc | 3.6 KB |
skill.json | config | 2.3 KB |
External hosts referenced
github.com elevenlabs.io openrouter.ai supadata.ai www.youtube.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/youtube-voice-summarizer-elevenlabs
- Raw scan result: youtube-podcast-summarizer-via-elevenlabs-scan.json
- Badge for your README:
- Request a re-scan