Youtube Search and Tracking API

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 11:02 AM UTC
• Version: 1.0.0

Overview

This skill is a straightforward YouTube search integration that sends user queries to AIsa using an API key, with no hidden persistence or unrelated access found.

Install only if you are comfortable sending YouTube search queries, country/language options, and filter tokens to AIsa. Keep AISA_API_KEY in a protected environment variable, avoid confidential search terms, and be aware the service appears pay-as-you-go.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 96% confidence
• Finding: The skill advertises executable capabilities that use environment variables and outbound network access, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent setting, this weakens least-privilege controls and can let the skill send user-provided queries and bearer-authenticated requests to an external service without clear governance.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search for videos
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI+agents+tutorial" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 94% confidence
• Finding: This example performs an authenticated request to an external API endpoint and sends the user's search query off-system. While expected for a search integration, it is still a real data egress point because both query contents and API credentials are involved in outbound network traffic.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search in specific country (US)
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=machine+learning&gl=us" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search in Japan

• Confidence: 94% confidence
• Finding: This command sends a user-controlled query and regional targeting parameters to a third-party service using bearer authentication. The risk is data egress rather than code execution, but in an autonomous agent workflow it can still leak sensitive research interests or internal context to the provider.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Search in Japan
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI&gl=jp&hl=ja" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 94% confidence
• Finding: This example also performs authenticated external transmission, now including language and country parameters that may reveal user targeting intent in addition to the query itself. In a benign search skill this is contextually expected, but it remains a genuine privacy and governance concern when used by agents on potentially sensitive inputs.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Search with interface language
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=python+tutorial&hl=en" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Chinese interface

• Confidence: 94% confidence
• Finding: The skill example transmits search content to api.aisa.one over the network with bearer authentication. This is standard integration behavior, but it is still a real egress channel through which sensitive search terms or workflow context could leave the environment.

External Transmission

Medium

• Category: Data Exfiltration

Content

-H "Authorization: Bearer $AISA_API_KEY"

# Chinese interface
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=编程教程&hl=zh-CN&gl=cn" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 94% confidence
• Finding: This is another authenticated external request that forwards the user's query and locale selections to the provider. The danger is not hidden malware but the possibility of unintended disclosure of user intent, sensitive topics, or business research through agent-initiated network traffic.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# Use sp parameter for pagination or advanced filters
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI&sp=<filter_token>" \
  -H "Authorization: Bearer $AISA_API_KEY"
```

• Confidence: 95% confidence
• Finding: This endpoint call transmits a query plus an opaque filter token to an external service under bearer authentication. Because filter tokens may encode pagination or search-state details, this broadens the amount of user activity metadata sent off-platform and should be treated as a genuine egress surface.

External Transmission

Medium

• Category: Data Exfiltration

Content

class YouTubeClient:
    """OpenClaw YouTube - YouTube SERP Scout API Client."""
    
    BASE_URL = "https://api.aisa.one/apis/v1"
    
    def __init__(self, api_key: Optional[str] = None):
        """Initialize the client with an API key."""

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill description and quick-start usage do not clearly warn that search terms are transmitted to a third-party API provider. This creates a privacy and data-handling risk because agents may forward sensitive user prompts, internal project names, or competitor research terms off-platform without informed consent.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: This code sends search queries to a third-party API and includes a bearer token from the environment in the request headers. Although the code has technical docstrings, it does not provide a user-facing disclosure in code output or prompts that entered search terms and credentials are being used in outbound network requests.

Static analysis

No suspicious patterns detected.