dlai-transcript-fetcher

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). This skill uses Chrome DevTools MCP to visit learn.deeplearning.ai lesson pages and explicitly extracts and downloads VTT subtitle files from public CDNs (e.g., video.deeplearning.ai or course-specific CDN domains) and then parses that transcript text into Markdown, so arbitrary third‑party page/subtitle content would be read and could influence subsequent outputs.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill requires running "npx chrome-devtools-mcp@latest" (i.e., fetching and executing the chrome-devtools-mcp package from the npm registry) as part of the MCP runtime configuration, which is a required runtime dependency that pulls and runs remote code.