v1.0.4

YouTube Outliers & Niche Finder Data by TubeLab

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:51 AM.

Analysis

This is a coherent TubeLab API reference skill that uses a TubeLab API key and credit-bearing endpoints, so users should monitor account usage but the behavior is disclosed and purpose-aligned.

GuidanceBefore installing, make sure you are comfortable giving the agent access to your TubeLab API key and with API calls potentially consuming TubeLab credits. There is no evidence of hidden code, persistence, credential exfiltration, or behavior outside the stated YouTube research purpose.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

Most endpoints cost credits... `POST /scan` | 50–100 credits

The skill documents API operations that can consume paid credits. This is disclosed and aligned with the TubeLab research purpose, but it is still a usage-impacting capability.

User impactSearches and scans may spend TubeLab credits if the agent uses them.

RecommendationReview or limit expensive scan/search requests, especially repeated or broad research tasks.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Every request requires an `Authorization` header with your API key: `Authorization: Api-Key $TUBELAB_API_KEY`

The skill requires a TubeLab API key, which grants access to the user's TubeLab account/API quota. This is expected for the stated API integration and no leakage or unrelated credential use is shown.

User impactIf installed, the agent can make TubeLab API requests using the configured API key.

RecommendationUse a revocable TubeLab API key, keep it out of shared logs/prompts, and monitor account usage.