中文 EN

扫描报告

扫描新文件

⚠ 低风险 — 风险评分 20/100
上次扫描：1 天前 重新扫描
20 /100
youtube-transcript
Fetch and summarize transcripts from any YouTube video using yt-dlp
A straightforward YouTube transcript fetcher with minor supply-chain concern (unused dependency) and a doc-to-code mismatch on shell execution capability.
技能名称youtube-transcript
分析耗时32.2s
引擎pi
✓
可以安装
Remove the unused `xml2js` dependency from package.json to reduce attack surface. Consider documenting the shell:WRITE capability in SKILL.md.

安全发现 2 项

严重性 安全发现 位置
低危
Unused dependency increases attack surface 供应链
package.json declares 'xml2js' as a dependency, but it is never imported or used in transcript.js. This adds an unnecessary third-party dependency without any functional benefit.
"xml2js": "^0.6.2"
→ Remove xml2js from the dependencies array if it is not used. Alternatively, remove it from package.json if only present as a transitive dependency.
 package.json:16
低危
Shell:WRITE capability not declared in SKILL.md 文档欺骗
SKILL.md states the skill 'uses yt-dlp' but does not explicitly declare that it invokes shell commands via execSync and spawnSync. The skill effectively uses shell:WRITE through tool invocations, which should be declared.
No declaration of shell execution capability
→ Add a Permissions section to SKILL.md listing shell:WRITE (for yt-dlp invocation) and filesystem:READ (for tmp file access).
 SKILL.md:1
资源类型声明权限推断权限状态证据
命令执行 NONE WRITE ✗ 越权 transcript.js:59 execSync('which yt-dlp'), transcript.js:75 spawnSync(ytdlp, [..…
文件系统 NONE READ ✗ 越权 transcript.js:80 fs.readFileSync(outFile), transcript.js:81 fs.unlinkSync(outFil…
网络访问 READ READ ✓ 一致 transcript.js:75 yt-dlp fetches captions via YouTube — correctly declared
环境变量 NONE NONE — No env access beyond PATH lookup for yt-dlp binary
3 项发现
🔗
中危 外部 URL 外部 URL
https://www.youtube.com/watch?v=LAdJsmTe8LM
SKILL.md:37
🔗
中危 外部 URL 外部 URL
https://www.youtube.com/watch?v=$
transcript.js:76
🔗
中危 外部 URL 外部 URL
https://www.youtube.com/watch?v=abc123
transcript.js:118

目录结构

4 文件 · 13.1 KB · 436 行
JSON 2f · 260L JavaScript 1f · 138L Markdown 1f · 38L
├─ 📋 package-lock.json JSON 238L · 8.0 KB
├─ 📋 package.json JSON 22L · 520 B
├─ 📝 SKILL.md Markdown 38L · 960 B
└─ 📜 transcript.js JavaScript 138L · 3.7 KB

依赖分析 1 项

包名版本来源已知漏洞备注
xml2js ^0.6.2 npm 否 Declared in package.json but NOT imported/used in transcript.js — dead dependency

安全亮点

✓ No credential harvesting or environment variable enumeration observed
✓ No base64, eval, or obfuscation patterns present
✓ No network calls to third-party hosts — only YouTube via yt-dlp
✓ File operations are scoped to os.tmpdir() only
✓ No persistence mechanisms (no cron, startup hooks, or backdoors)
✓ URL validation present (extractVideoId function)
✓ Clean VTT sanitization with HTML tag stripping and deduplication