ClawHub
Back to skill

Security audit

YouTube SERP Scout for agents. Search top-ranking videos, channels, and trends for content research and competitor tracking

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward YouTube search helper that sends user-directed queries to AIsa using a declared API key.

Install only if you trust the publisher and AIsa. Use a dedicated, revocable AISA_API_KEY, monitor usage or credits, and avoid submitting secrets, personal data, or confidential business research terms because queries are sent to api.aisa.one.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill metadata declares required binaries and an API key environment variable, and the skill documentation clearly instructs users to make outbound requests to a third-party API, yet no explicit permissions model is declared. In an agent setting, undeclared access to environment variables and network capabilities weakens transparency and informed consent, making it easier for a host or user to underestimate what the skill can access and where data may be sent.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill demonstrates authenticated requests to api.aisa.one using a bearer token and user-supplied search queries, but it does not clearly disclose that prompts, search terms, IP-derived metadata, headers, and usage data may be transmitted to and logged by a third-party service. For research workflows, queries can contain sensitive business intelligence, customer information, or internal investigation topics, so the missing disclosure creates a real privacy and data-handling risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.