ClawHub
Back to skill

Security audit

Youtube Search and Tracking API

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward YouTube search helper that uses a declared API key to call the AIsa service.

Install only if you intend to use AIsa as an external YouTube search provider. Treat AISA_API_KEY as a secret, avoid exposing it in logs or transcripts, and remember that your search terms and request parameters will be sent to AIsa.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares required binaries and an environment variable in metadata and provides commands that make outbound network requests using a bearer token, but there is no explicit permission model or warning to the agent/user about those capabilities. In an agent ecosystem, undeclared access to environment secrets and network egress increases the chance that an agent will use credentials and contact external services without informed approval or policy enforcement.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The markdown examples instruct users/agents to send an Authorization bearer token to a remote third-party API but provide no privacy, scoping, logging, or data-handling warning. In an autonomous-agent context, example commands are often executed or adapted directly, so normalizing secret transmission without guardrails can lead to unintended credential exposure, use in untrusted environments, or silent external calls.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.