ClawHub
Back to skill

Security audit

finding-youtube-sponsorship-candidates

Security checks for vulnerabilities and agentic risk

Overview

This skill clearly helps users find YouTube sponsorship prospects through Apify, with the main caution being that searches and an Apify token are sent to Apify as part of its intended operation.

Install only if you are comfortable sending YouTube search terms and target-channel URLs to Apify under your Apify account. Prefer MCP or a wrapper that avoids placing APIFY_TOKEN in command URLs, and avoid passing sensitive business strategy details as search terms unless Apify is an acceptable processor for that data.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "searchKeywords": ["best personal finance tools", "personal finance review"],
    "maxResults": 50,
    "type": "video"
Confidence
90% confidence
Finding
The referenced https://api.apify.com endpoint is an external network destination, so use of this skill results in data leaving the local environment. In context this is expected functionality, but it still creates a real privacy and credential-handling risk because the example sends requests to a third party using a URL that contains the API token.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST   "https://api.apify.com/v2/acts/apidojo~youtube-scraper/runs?token=$APIFY_TOKEN"   -H "Content-Type: application/json"   -d '{
    "searchKeywords": ["best personal finance tools", "personal finance review"],
    "maxResults": 50,
    "type": "video"
Confidence
90% confidence
Finding
The referenced https://api.apify.com endpoint is an external network destination, so use of this skill results in data leaving the local environment. In context this is expected functionality, but it still creates a real privacy and credential-handling risk because the example sends requests to a third party using a URL that contains the API token.

Static analysis

No suspicious patterns detected.