ClawHub
Back to skill

Security audit

Search YouTube videos, channels, and playlists

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a documented YouTube search wrapper, but it expands beyond that scope and includes unsafe API-key troubleshooting guidance.

Install only if you are comfortable giving the agent network access to AIsa using your AISA_API_KEY. Avoid the LLM and web-search examples unless you explicitly intend to use those separate AIsa services, and do not run the troubleshooting command that prints the API key; use a presence check instead and rotate the key if it appears in logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:382
Finding

API Key Exposure Through Troubleshooting Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 382–385
Vulnerability Type: Sensitive credential exposure through terminal output
Risk Level: Medium

Vulnerable Code:

bash
1. Check that the `AISA_API_KEY` environment variable is set:

```bash
echo $AISA_API_KEY

Technical Analysis

The troubleshooting procedure instructs the user or agent to print the complete AISA_API_KEY value to standard output. Although this does not transmit the key to an undeclared endpoint, it unnecessarily exposes a bearer credential when only its presence needs to be verified.

Terminal output can be retained in AI-agent tool transcripts, CI/CD logs, remote shell recordings, support bundles, screen-sharing sessions, or other monitoring systems. Because the Skill describes the key as unified across multiple AIsa services and all requests are pay-per-use, disclosure may affect more than the YouTube search endpoint.

The regular transmission of this credential in the HTTPS Authorization header to api.aisa.one is necessary for the declared API functionality and is not treated as covert exfiltration. The vulnerability is specifically the unnecessary plaintext display of the credential.

Attack Path

  1. A user encounters an authentication problem and follows the documented troubleshooting instructions.
  2. The user or agent executes echo $AISA_API_KEY.
  3. The complete bearer credential is written to terminal output.
  4. The output is captured in an agent transcript, CI log, shell recording, screen share, or support artifact.
  5. A party with access to that output extracts the key.
  6. The party uses the key to authenticate to supported AIsa endpoints and consume account resources until the key is revoked or expires.

Impact Assessment

An exposed key may allow unauthorized authentication to AIsa services available to the affected account. Potential impact includes unauthorized paid API consumption, ex ...[truncated 399 chars]

Remediation
View remediation

Remediation Suggestions

Replace the secret-printing command with a presence check that never displays the value:

bash
if [ -n "${AISA_API_KEY:-}" ]; then
  echo "AISA_API_KEY is set"
else
  echo "AISA_API_KEY is not set"
fi

Additional hardening measures:

  • Explicitly warn users never to print, paste, log, or commit the API key.
  • Recommend rotating the key immediately if it appears in terminal or agent logs.
  • Redact Authorization headers and AISA_API_KEY values in diagnostic output.
  • Use a dedicated, least-privileged key for this Skill if AIsa supports scoped credentials.
  • Avoid reusing one broadly privileged key across unrelated services where scoped alternatives are available.
  • Ensure CI/CD systems and agent runtimes mask the AISA_API_KEY environment variable in logs.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (21)

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly says other AIsa capabilities belong in aisa-core, but later instructs users to use LLM and web-search features from this skill anyway. This contradiction can mislead an agent into over-permissioned behavior, causing unintended use of additional APIs and data flows outside the skill's stated scope.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 38)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 218)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 258)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 288)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 395)May include surrounding context.

md
python <<'EOF'
import os, json, requests
results = requests.get(
    'https://api.aisa.one/apis/v1/youtube/search',
    headers={'Authorization': f'Bearer {os.environ["AISA_API_KEY"]}'},
    params={'engine': 'youtube', 'q': 'coding tutorial'}
).json()

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill is presented as a YouTube search skill, but it expands into unrelated LLM and web-search workflows that transmit retrieved data to additional remote endpoints. This broadens the skill's trust boundary and can cause users or agents to send search-derived content to services they did not intend to invoke under this skill, increasing data handling and policy risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The documented POST to the chat completions endpoint demonstrates external transmission of data outside the core YouTube search operation. In a skill context, this is dangerous because it encourages chaining services with the same API key and can cause agents to exfiltrate intermediate results to additional remote systems without clear scope separation.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md
# 2. Summarize with LLM (same API key!)
video_titles = [v['title'] for v in yt_results.get('videos', [])[:5]]
summary = requests.post(
    'https://api.aisa.one/v1/chat/completions',
    headers={**headers, 'Content-Type': 'application/json'},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

The documented POST to the chat completions endpoint demonstrates external transmission of data outside the core YouTube search operation. In a skill context, this is dangerous because it encourages chaining services with the same API key and can cause agents to exfiltrate intermediate results to additional remote systems without clear scope separation.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md
# 2. Summarize with LLM (same API key!)
video_titles = [v['title'] for v in yt_results.get('videos', [])[:5]]
summary = requests.post(
    'https://api.aisa.one/v1/chat/completions',
    headers={**headers, 'Content-Type': 'application/json'},
    json={

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

This line targets a different AIsa service than the advertised YouTube search API, causing data obtained under one skill to be forwarded to another remote endpoint. That scope expansion is risky because agents may treat the entire workflow as implicitly approved, resulting in unintended disclosure or policy bypass through service chaining.

Content

Scanner excerpt · SKILL.md (reported line 327)May include surrounding context.

md
# 2. Summarize with LLM (same API key!)
video_titles = [v['title'] for v in yt_results.get('videos', [])[:5]]
summary = requests.post(
    'https://api.aisa.one/v1/chat/completions',
    headers={**headers, 'Content-Type': 'application/json'},
    json={
        'model': 'qwen3-flash',

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

This example sends data to the AIsa smart web-search endpoint, which is outside the declared YouTube search capability. Including this in the skill documentation encourages cross-capability invocation and additional external data transmission that users may not expect from a narrowly scoped search skill.

Content

Scanner excerpt · SKILL.md (reported line 351)May include surrounding context.

md
).json()

web_results = requests.get(
    'https://api.aisa.one/apis/v1/search/smart',
    headers=headers,
    params={'q': 'AI agent frameworks 2026'}
).json()

Static analysis

No suspicious patterns detected.