ClawHub
Back to skill

Security audit

YouTube Search

Security checks across malware telemetry and agentic risk

Overview

The skill performs the advertised YouTube search function through TranscriptOut, but its setup handles and persistently stores live API credentials in a way users should review first.

Review this before installing if you are not comfortable letting the agent handle a TranscriptOut account credential. Prefer entering the API key through a platform secret manager when available, avoid pasting live keys into chat, and confirm where TRANSCRIPTOUT_API_KEY will be stored and how to revoke it later.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Description-Behavior Mismatch

High
Confidence
99% confidence
Finding
This document is materially unrelated to a YouTube search skill and instead instructs the agent to obtain, verify, and persist a third-party API credential. That mismatch expands the skill's authority far beyond its stated purpose and can be used to justify secret handling and account actions the user would not reasonably expect in this context.

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The instructions tell the agent to create third-party accounts, collect email-based authentication codes, extract access tokens, and persist an API key across sessions. For a YouTube search skill, these are unjustified privileged operations that create unnecessary exposure of user credentials, expand attack surface, and normalize long-term secret retention.

Missing User Warnings

Medium
Confidence
93% confidence
Finding
The document explicitly asks the user to paste a live `sk_` API key into the chat without warning that this is a sensitive secret. That increases the chance the credential is exposed in conversation logs, tool traces, transcripts, or to downstream systems that the user does not realize can access chat content.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill directs persistent storage of the API key for future sessions, including non-interactive shells, but does not clearly disclose the retention scope, lifespan, or who may be able to access that stored secret later. This undermines informed consent and can leave durable credentials on the system longer than the user expects.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.