skills/gooseworks-ai/gooseworks-skills/youtube-apify-transcript/Socket

youtube-apify-transcript

Warn

Audited by Socket on Oct 10, 2026

1 alert found:

Anomaly

Anomalyscripts/fetch_transcript.py

LOW

AnomalyLOW

scripts/fetch_transcript.py

The code appears to implement a YouTube transcript-fetching CLI and shows no clear intentional malware behavior. However, unvalidated video IDs can affect cache paths and enable path traversal in cache file operations. The API key is also sent to the environment-configured host, so an untrusted GOOSEWORKS_API_BASE value can disclose credentials.

Confidence: 97%Severity: 55%

Audit Metadata

Analyzed At

Oct 10, 2026, 07:32 PM

Package URL

pkg:socket/skills-sh/gooseworks-ai%2Fgooseworks-skills%2Fyoutube-apify-transcript%2F@b6ba00d0845c57a3a2ed05e98f78877334e6641bbfc4df4b849aa3052ecc31b4