Youtube Audio Download

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:44 AM UTC
• Version: 1.0.6

Overview

This skill has a coherent YouTube audio-download purpose, but its tool entry runs an unbundled absolute-path Python file and it asks for cookies without safe-handling guidance.

Review this package before installing. It should bundle the actual downloader script and use a package-relative entry path, and it should clearly explain how to protect any cookies file. Do not provide personal browser cookies unless you trust the exact code being executed and can keep the cookie file private and temporary.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: openclaw.plugin.json:9

Finding

External Executable Entry Allows Tool Implementation Replacement

Content

View full analysis

Vulnerability Details

File Location: openclaw.plugin.json, line 9
Vulnerability Type: Tool hijacking through an external absolute entry path
Risk Level: High

Vulnerable Code

json

"entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/download_audio.py"

Technical Analysis

The plugin delegates execution of the download_audio tool to an absolute filesystem path outside the audited package. The referenced Python file is absent from the supplied artifact, so its integrity and behavior cannot be established through review of this package.

This creates a trust-boundary failure: the reviewed plugin configuration can remain unchanged while the effective implementation is replaced by modifying the external file. The path also conflicts with the package-relative command documented at SKILL.md:10:

bash

python scripts/download_audio.py <URL> [--cookies cookies.txt] [--output-dir dir]

Consequently, the package is not self-contained, and the runtime implementation may differ from the documented and reviewed behavior. The handling of cookie files, command arguments, network destinations, downloaded data, and filesystem side effects cannot be verified.

Attack Path

1. An attacker obtains write access to the external file or one of its parent directories at /mnt/h/AI/openclaw_workspace/video_translate/skills/.
2. The attacker creates or replaces download_audio.py with attacker-controlled Python code.
3. The package configuration continues to advertise the legitimate-looking download_audio tool.
4. A user or Agent invokes that tool.
5. OpenClaw resolves the absolute entry and executes the substituted implementation.
6. The attacker-controlled code runs with the filesystem, network, and process privileges available to the plugin host.

Impact Assessment

Successful exploitation permits arbitrary behavior within the privileges of the process executing the plugi ...[truncated 624 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the complete download_audio.py implementation in the distributed package, preferably under a package-owned directory such as scripts/.

2. Replace the absolute entry with a package-relative path, for example:

   json

   "entry": "scripts/download_audio.py"
   

3. Resolve and canonicalize the configured entry at load time, then reject it unless the resolved path remains inside the package root.

4. Reject symbolic-link or junction traversal that could redirect a package-relative entry outside the package.

5. Ensure the manifest and SKILL.md reference the same implementation path.

6. Include the executable implementation in code review, release artifacts, and integrity checks. Where supported, verify signed packages or cryptographic hashes before execution.

7. Apply least privilege to the plugin runtime and restrict access to cookie files, unrelated filesystem locations, subprocess execution, and unnecessary network destinations.

8. Add packaging tests that fail when a declared entry is absent, external to the package, or inconsistent with the documented command.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly supports passing a cookies.txt file for age-restricted videos but does not warn that browser authentication cookies are sensitive secrets that can enable account access or session hijacking if mishandled. In an agent/tooling context, users may be encouraged to provide exported cookies without understanding the security and privacy implications, increasing the chance of credential exposure through logs, workspace files, or downstream tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The description explicitly advertises support for age-restricted videos via cookies, which implies the skill may accept or process browser/session authentication material. Referencing cookie-based access without any warning, scope limitation, or secure-handling guidance creates a real risk that users will provide sensitive session cookies that could be exposed, reused, or mishandled. In this context, the skill is more dangerous because YouTube/account cookies can represent active authenticated sessions rather than low-value tokens.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.