Security audit
Security checks for vulnerabilities and agentic risk
This is a documented TubeLab API reference skill that uses an API key and can spend TubeLab credits, with no hidden persistence or local system changes.
Install only if you intend to give the agent access to your TubeLab API key. Treat scan creation as a paid action, confirm before running POST /scan, and avoid storing or redistributing retrieved comments or transcripts unless needed for your task.
The skill explicitly documents retrieval of video transcripts and the last 100 comments, which can include user-generated content and personal data, but it provides no privacy, minimization, or handling guidance. In an agent setting, this omission can lead to collection, summarization, storage, or onward sharing of personal data without the user appreciating the sensitivity.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Cost: 50–100 credits per request.
curl -s -X POST "https://public-api.tubelab.net/v1/scan" \
-H "Authorization: Api-Key $TUBELAB_API_KEY" \
-H "Content-Type: application/json" \
-d '{"findBy":"query","query":["UCUyeluBRhGPCW4rPe_UvBZQ","UCX6OQ3DkcsbYNE6H8uQQuVA"],"mode":"standard"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Cost: 50–100 credits per request.
curl -s -X POST "https://public-api.tubelab.net/v1/scan" \
-H "Authorization: Api-Key $TUBELAB_API_KEY" \
-H "Content-Type: application/json" \
-d '{"findBy":"query","query":["UCUyeluBRhGPCW4rPe_UvBZQ","UCX6OQ3DkcsbYNE6H8uQQuVA"],"mode":"standard"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# Page 1 (items 0-19)
curl -s "https://public-api.tubelab.net/v1/search/outliers?query=minecraft%20adventures&type=video&from=0&size=20" \
-H "Authorization: Api-Key $TUBELAB_API_KEY"
# Page 2 (items 20-39)
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
ONE_YEAR_AGO=$(date -u -d "1 year ago" +%Y-%m-%dT00:00:00Z 2>/dev/null || date -u -v-1y +%Y-%m-%dT00:00:00Z)
curl -s "https://public-api.tubelab.net/v1/search/channels?monetizationAdsense=true&revenueMonthlyEstimationFrom=1000&subscribersFrom=1000&publishedAtFrom=$ONE_YEAR_AGO&language=en&language=de&language=fr&excludeNiche=music&excludeNiche=song&excludeNiche=lofi&excludeNiche=movies&excludeNiche=kids&excludeNiche=news&excludeNiche=politic&sortBy=foundAt&size=20" \
-H "Authorization: Api-Key $TUBELAB_API_KEY"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
SIX_MONTHS_AGO=$(date -u -d "6 months ago" +%Y-%m-%dT00:00:00Z 2>/dev/null || date -u -v-6m +%Y-%m-%dT00:00:00Z)
curl -s "https://public-api.tubelab.net/v1/search/channels?avgViewsToSubscribersRatioFrom=1&averageViewsFrom=10000&subscribersFrom=100&publishedAtFrom=$SIX_MONTHS_AGO&language=en&language=de&language=fr&excludeNiche=music&excludeNiche=song&excludeNiche=lofi&excludeNiche=movies&sortBy=foundAt&size=20" \
-H "Authorization: Api-Key $TUBELAB_API_KEY"
The POST /scan operation consumes 50–100 credits per request, but the skill does not require an explicit confirmation step before initiating that paid action. In agent workflows, this can cause unintended billable operations or repeated polling/creation patterns that waste credits.
No suspicious patterns detected.