ClawHub
Back to skill

Security audit

scraping-youtube-channel-data

Security checks across malware telemetry and agentic risk

Overview

This skill uses an external Apify scraper with a token, but the exact actor and scope are inconsistent enough that users should review it before installing.

Install only if you are comfortable sending the requested YouTube URLs, handles, keywords, and related scraping inputs to Apify under your APIFY_TOKEN. Before use, confirm which Apify actor should run and limit inputs to the intended channel-data workflow unless you explicitly want broader YouTube scraping.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Intent-Code Divergence

High
Confidence
98% confidence
Finding
The metadata declares one Apify actor while the workflow invokes a different actor name, creating a confused-deputy risk where operators may execute a different external service than the one they reviewed or approved. In a skill that sends requests to third-party infrastructure using an API token, this mismatch can lead to unintended data disclosure, unexpected scraping behavior, billing abuse, or use of an actor with different trust and data-handling properties.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The manifest description frames the skill as focused on channel statistics and channel video catalogs for lists of channels. However, the documented inputs expand the behavior to unrelated retrieval modes such as playlists, Shorts, search keyword scraping, and trending videos, which go beyond channel-centric data collection.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
**REST API fallback:**
```bash
curl -X POST \
  "https://api.apify.com/v2/acts/apidojo~youtube-channel-scraper/runs?token=$APIFY_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"channelUrls": ["https://www.youtube.com/@channelhandle"], "maxVideos": 30}'
```
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.