Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent YouTube management connector, but it gives agents high-impact publishing and deletion abilities without clear confirmation or rollback guidance.
Install only if you are comfortable letting an agent operate an AgentPMT-connected YouTube account. Before using it, require manual confirmation for public uploads, privacy changes, subscriber notifications, branding changes, and any delete or remove action, and prefer OpenClaw install routes or version-pinned setup commands over floating npx examples.
The skill prominently supports changing video privacy, publication timing, branding, and channel organization, but it does not foreground user warnings about visibility changes or public-facing impact. In a YouTube-management context, accidental changes can immediately expose content, notify subscribers, or alter the public channel presentation.
The skill documents destructive operations such as delete_video, delete_caption, delete_playlist, and removal actions without requiring confirmation or warning the operator about irreversible channel changes. In an agent setting, this increases the chance of accidental or prompt-induced destructive actions against production content.
The skill instructs users to install supporting skills via npx skills ... without pinning a specific package version or immutable source. That creates a supply-chain risk: a later compromised or incompatible package release could be fetched and executed during installation, leading to arbitrary code execution on the user's machine or altered skill behavior.
This line again references npx skills without a pinned version, exposing users to unreviewed future package changes at install time. In a skill ecosystem, that can silently introduce malicious code or breaking changes into the trusted setup path.
The unpinned npx skills invocation leaves dependency resolution to the latest published package state. If the package, transitive dependency, or namespace is compromised, users could execute attacker-controlled code while following the skill instructions.
This installation example uses a floating npx skills command, which is a common supply-chain weakness because it trusts the latest package publication at execution time. That can result in local code execution or installation of altered helper skills if the registry package changes.
Another floating npx skills install command repeats the same supply-chain exposure. Users following the documented setup could run untrusted or newly modified code outside the reviewed skill contents.
The skill references an unpinned npx skills command in the security-sensitive account setup/tooling context. Because this skill is designed to manage external accounts and publish content, compromise of the installer path could have downstream access to credentials, tokens, or tool invocations.
This is the same unpinned package execution issue in another setup reference. The risk is amplified by the surrounding context, which involves connecting account/MCP infrastructure; a compromised installer could tamper with connection settings or exfiltrate secrets.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/youtube-api
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- What AgentPMT is: ../what-is-agentpmt (ClawHub: `what-is-agentpmt`, page: https://clawhub.ai/agentpmt/what-is-agentpmt; skills.sh: `npx skills add AgentPMT/agent-skills --skill what-is-agentpmt`)
- AgentPMT account MCP/REST setup: ../agentpmt-account-mcp-rest-api-setup (ClawHub: `agentpmt-account-mcp-rest-api-setup`, page: https://clawhub.ai/agentpmt/agentpmt-account-mcp-rest-api-setup; skills.sh: `npx skills add AgentPMT/agent-skills --skill agentpmt-account-mcp-rest-api-setup`)
- Marketplace product: https://www.agentpmt.com/marketplace/youtube-api
- AgentPMT main MCP server: https://api.agentpmt.com/mcp/
- AgentPMT REST invoke endpoint: https://api.agentpmt.com/products/purchase
The schema documents irreversible actions such as delete-video, delete-playlist, delete-caption, and delete-channel-section without prominent warnings or confirmation guidance. In an agentic setting, this increases the chance of accidental destructive calls, especially when an LLM may infer actions from ambiguous user instructions.
The manifest description emphasizes uploading videos and updating metadata, privacy, localizations, thumbnails, captions, playlists, channel sections, branding, and watermarks. This schema additionally exposes explicit destructive operations like delete_caption, delete_channel_section, delete_playlist, and delete_video, which are not described in the manifest text and materially expand the operational scope.
The download-caption action states that caption data will be saved to AgentPMT File Manager, but does not clearly warn that the action writes a new artifact to persistent storage. This can surprise users and agents, creating data-handling and privacy issues if sensitive captions are stored unexpectedly.
No suspicious patterns detected.