ClawHub
Back to skill

Security audit

Pub Youtube

Security checks for vulnerabilities and agentic risk

Overview

This package is labeled as a YouTube transcript helper but actually documents a broad third-party API gateway with email, SMS, media generation, search, scraping, and arbitrary model calls.

Review this as a broad SkillBoss API gateway, not a narrow YouTube transcript watcher. Install only if you intend to let the agent use your SKILLBOSS_API_KEY for external model calls and potentially send prompts, documents, audio, image URLs, email addresses, and phone numbers to third-party services; avoid using it for communication actions unless you can enforce explicit user approval and recipient checks.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (43)

Description-Behavior Mismatch

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill is presented as a narrow YouTube transcript watcher, but the documentation exposes a broad general-purpose broker for chat, generation, scraping, email, and SMS. This scope mismatch is dangerous because users or higher-level agents may grant trust, inputs, and privileges appropriate for transcript retrieval while the skill actually enables unrelated outbound actions and data flows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Outbound email is unrelated to YouTube transcript retrieval and creates a direct exfiltration and action channel. In the context of a seemingly harmless summarization skill, this hidden breadth increases the risk that user content, summaries, or sensitive data could be transmitted externally without informed consent.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

SMS OTP send/verify capability is highly unrelated to transcript watching and introduces sensitive identity and communications functionality. This broadens the skill into user-targeted external actions that could be abused for unsolicited messaging, phishing workflows, or handling of personal phone numbers under a misleading skill identity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

Email and SMS sending capabilities are high-risk outbound communication functions that are unrelated to the stated transcript-reading purpose. If exposed through this skill, they could be abused for spam, phishing, OTP workflows, or unauthorized notifications under the cover of a benign-seeming YouTube utility.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
85% confidence
Finding

The base URL declaration establishes that the skill depends on a third-party API for many operations, meaning user data and prompts may leave the local environment. In isolation this is common, but here it contributes to a broad and under-disclosed external trust dependency.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
One API key, 50+ models across providers (Bedrock, OpenAI, Vertex, ElevenLabs, Replicate, Minimax, and more). Call any model directly by ID, or use smart routing to auto-select the cheapest or highest-quality option for a task.

**Base URL:** `https://api.heybossai.com/v1`
**Auth:** `-H "Authorization: Bearer $SKILLBOSS_API_KEY"`

## List Models

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The models-list call is an external request that leaks at least token usage and environment metadata to a third-party service. While low severity on its own, it confirms unnecessary external connectivity in a skill whose declared purpose is much narrower.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The models-list call is an external request that leaks at least token usage and environment metadata to a third-party service. While low severity on its own, it confirms unnecessary external connectivity in a skill whose declared purpose is much narrower.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

List Models

bash
curl -s https://api.heybossai.com/v1/models \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Filtering models by type still makes an external call and supports generic capability discovery rather than transcript retrieval. This broadens what downstream agents may attempt with the skill.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

Filter by type:

bash
curl -s "https://api.heybossai.com/v1/models?types=image" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

Fetching full docs for arbitrary models is an external transmission path that facilitates broad general-purpose use of the API. In this context, it amplifies the scope mismatch and supports capabilities unrelated to transcript watching.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

Get full docs for specific models:

bash
curl -s "https://api.heybossai.com/v1/models?ids=mm/img,bedrock/claude-4-5-sonnet" \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

A general chat completion and smart-routing interface turns the skill into a generic LLM gateway rather than a dedicated transcript watcher. This makes the skill more dangerous because arbitrary prompts and data can be routed to external model providers under the guise of a narrow-purpose tool.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The chat completions endpoint sends arbitrary prompts and content to an external provider. Because this skill is framed as a transcript watcher, that generic external prompt channel is more dangerous than it would be in a clearly labeled LLM gateway.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

Chat

bash
curl -s -X POST https://api.heybossai.com/v1/chat/completions \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Image and video generation are unjustified by the stated transcript-reading purpose and materially expand what the skill can do. Even if not inherently malicious, this scope creep undermines least privilege and increases the chance of misuse, surprise charges, or unreviewed external data transfers under a misleading skill label.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This external run endpoint is used for image generation and transmits prompts to a third party. It is unnecessary for the stated use case and enlarges the skill's data exposure surface.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This external run endpoint is used for image generation and transmits prompts to a third party. It is unnecessary for the stated use case and enlarges the skill's data exposure surface.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

Image Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This workflow not only sends a generation request externally but also retrieves a returned URL, increasing network interaction and data movement. That is excessive for a transcript-reading skill and can lead to additional unreviewed content fetching.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

Save to file:

bash
URL=$(curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"model": "mm/img", "inputs": {"prompt": "A sunset over mountains"}}' \

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The video generation call forwards user prompts to an external API and expands the skill into unrelated media creation. This widens the outbound attack surface and departs from least privilege.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The video generation call forwards user prompts to an external API and expands the skill into unrelated media creation. This widens the outbound attack surface and departs from least privilege.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

Video Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The image-to-video example sends both text and a user-specified image URL externally, which may expose third-party or sensitive media. It is not justified by the advertised skill purpose.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

Image-to-video:

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

TTS, STT, and music generation are not necessary for a dedicated YouTube transcript watcher and expand processing of user audio/text beyond the declared purpose. This can lead to unexpected transmission of audio content and unnecessary privilege exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This TTS external call transmits user text to a third party and may return remote-hosted audio. It is another unnecessary data transfer path for this skill's declared function.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

This TTS external call transmits user text to a third party and may return remote-hosted audio. It is another unnecessary data transfer path for this skill's declared function.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

Text-to-Speech

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The speech-to-text external call uploads raw audio content, which can be highly sensitive and may reveal identities or private conversations. This is particularly concerning because the skill description does not prepare users for such audio uploads.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The speech-to-text external call uploads raw audio content, which can be highly sensitive and may reveal identities or private conversations. This is particularly concerning because the skill description does not prepare users for such audio uploads.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

Speech-to-Text

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
87% confidence
Finding

Music generation transmits prompts externally and supports nonessential functionality unrelated to transcript watching. This broadens potential data egress and billing abuse without clear justification.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

Music Generation

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
86% confidence
Finding

Background-removal requests send image references or content to an external service, expanding third-party exposure beyond the skill's advertised purpose. It is another sign of overbroad functionality hidden inside a narrowly named skill.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

Background Removal

bash
curl -s -X POST https://api.heybossai.com/v1/run \
  -H "Authorization: Bearer $SKILLBOSS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{

Static analysis

No suspicious patterns detected.