youtube-transcript

The script has a shell-profile command-injection risk because YOUTUBE_TRANSCRIPT_KEY_FILE is interpolated unescaped into persistent shell code. Its configurable API base can also redirect the request that carries the API key, and the configurable key-file path affects where credentials are written. These environment variables should be trusted or validated, and the profile path must be safely quoted or avoided. No clear standalone malware behavior is present.