YouTube Content Manager Pro

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:55 AM UTC
• Version: 1.0.0

Overview

This skill is a plausible YouTube content tool, but it needs review because it sends content to an undisclosed AI provider, embeds live-looking secrets, has unclear billing behavior, and runs an unsafe web app configuration.

Review before installing or running. Do not use confidential channel plans or unpublished scripts until the provider disclosure is corrected. Remove and rotate embedded API keys, replace the Flask secret with a deployment-specific secret, disable debug mode and 0.0.0.0 binding, fix billing amounts and consent screens, add record-level user isolation, and replace unsafe HTML rendering before exposing this app to a network.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (6)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/app.py:18

Finding

Hard-Coded API Credentials and Predictable Flask Session Secret

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/app.py:435

Finding

Flask Debug Server Exposed on All Network Interfaces

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/index.html:125

Finding

Stored and DOM-Based Cross-Site Scripting Through Unsanitized HTML Rendering

Content

View full analysis

{ const item = document.createElement('a'); item.className = 'list-group-item list-group-item-action'; item.href = 'javascript:;'; item.innerHTML = ` ${video.title}
👁️ ${video.views || 0} views | ${new Date(video.created_at).toLocaleDateString()} `; item.onclick = () => loadVideo(video.id); list.appendChild(item); }); function renderVideo(video) { const result = document.getElementById('result'); result.innerHTML = `

${video.title}

📝 Full Script

${video.script}

🏆 Title Options

${JSON.parse(video.titles).map((title, i) => `

${i+1}. ${title}

`).join('')}

📄 SEO Description

${video.description}

🏷️ Tags

${video.tags}

🖼️ Thumbnail Suggestion

${video.thumbnail}

📥 Export All Content

`; } ``` The generated topic list contains the same pattern at `templates/index.html:203-215`: ```javascript data.topics.forEach(topic => { const item = document.createElement('div'); item.className = 'topic-item'; item.innerHTML = ` ${topic.title}

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/app.py:350

Finding

Missing Record-Level Authorization and Cross-User Data Isolation

Content

View full analysis

= ? GROUP BY topic ORDER BY total_views DESC''', (thirty_days_ago,)) c.execute('SELECT title FROM publish_records WHERE views > 10000') ``` ...[truncated 1517 chars]

Remediation

View remediation

other

Warning

• Location: scripts/app.py:34

Finding

Undisclosed Transmission of User Content to an External AI Provider

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/app.py:109

Finding

Billing Amounts Conflict With Advertised Pricing

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented purpose does not fully disclose external billing enforcement, persistent storage of user content and analytics, or charging behavior that differs from the stated pricing. This mismatch is dangerous because users and platforms may expose sensitive content, API keys, or funds under false assumptions about what the skill does and how it charges.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 80% confidence

Finding

The skill advertises capabilities that imply network use and payment verification, but it does not declare any explicit tool scope or allowed tools. This creates a transparency and governance gap: a host or reviewer cannot clearly determine what external access the skill expects, increasing the risk of unauthorized network actions or data egress.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The manifest description presents the skill as an all-in-one YouTube content tool but does not specify any narrow invocation conditions, trigger phrases, or exclusions. For a manifest file, this can create ambiguity about when the skill should be selected versus other general writing or analytics skills.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

Claiming 'Local data storage, 100% safe' is misleading when the skill also depends on external payment verification and an OpenAI API key, both of which involve off-device data flows and trust in third parties. Overstated safety claims can cause users to provide sensitive content or credentials without understanding the actual exposure surface.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation presents local storage as safe without warning users about external API-key usage or broader data handling. This can mislead users into believing their content never leaves the local environment, increasing the chance of unintended disclosure of proprietary scripts, channel analytics, or credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/app.py (reported line 35)May include surrounding context.

python

# 硅基流动API配置
SILICONFLOW_API_KEY = 'sk-ggfjehtmwgthcdyajhpipxhurytmnmqsnvpfzoripdgdmzar'
SILICONFLOW_API_URL = 'https://api.siliconflow.cn/v1/chat/completions'
AI_MODEL = 'Doubao-ai/doubao-seed-v2-18k'

# 调用硅基流动API函数

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

User-provided prompts are transmitted to an external AI provider without any visible notice or consent mechanism in this file. This creates a privacy and data-handling risk because users may submit sensitive business plans, channel strategies, or unpublished content that is silently sent to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This endpoint sends user-supplied content to an external AI API. In the context of a content-management skill, users are likely to submit unpublished scripts, channel plans, or commercially sensitive prompts, so undisclosed third-party transmission raises meaningful confidentiality risk.

Content

Scanner excerpt · scripts/app.py (reported line 51)May include surrounding context.

python

'max_tokens': 4000
    }
    try:
        response = requests.post(SILICONFLOW_API_URL, headers=headers, json=payload, timeout=60)
        if response.status_code == 200:
            return response.json()['choices'][0]['message']['content']
        else:

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The billing logic is inconsistent with the marketed paid-per-use model and sends a zero-value charge in the per-request flow. This can lead to unauthorized access control decisions, billing bypasses, or deceptive charging behavior because payment verification is tied to flawed charging semantics.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The application sends user identifiers to an external billing provider during charge attempts without any visible disclosure in this code. This is dangerous because billing identifiers are personal/account-linked data, and silent sharing can violate user expectations, privacy requirements, or platform policies.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The charge request transmits a user identifier to an external billing system and is also tied to flawed access-control logic. This is risky because it combines privacy exposure with the possibility of improper authorization decisions based on external billing responses.

Content

Scanner excerpt · scripts/app.py (reported line 115)May include surrounding context.

python

if TEST_MODE:
        return {"ok": True, "balance": 1000}
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The payment-link route transmits user billing information to a third-party payment service without visible disclosure in the code. This increases privacy and compliance risk because users may be redirected into an external payment flow without a clear explanation of what data is being shared.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The payment-link request sends user billing data to a third party and redirects the user based on the returned URL. While external payment processing is expected, doing so without visible disclosure or stronger validation creates privacy and trust concerns.

Content

Scanner excerpt · scripts/app.py (reported line 146)May include surrounding context.

python

if TEST_MODE:
        return redirect(url_for('index', test_payment='success'))
    try:
        resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
            "user_id": user_id, "amount": 8,
        }, timeout=10)
        payment_url = resp.json().get("payment_url")

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest describes an all-in-one YouTube content management tool covering thumbnails and analytics, which implies substantive YouTube-facing management capabilities. In code, thumbnail handling is limited to returning AI-generated text/color suggestions (L270-L274, L340-L346), and analytics are only user-supplied records saved to SQLite and summarized locally (L350-L430), with no YouTube API access or real channel management operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Server-fetched video fields such as title, script, description, tags, thumbnail, and parsed titles are interpolated directly into result.innerHTML. If any of that content is AI-generated, user-supplied, or stored data that can contain HTML/JavaScript, an attacker can trigger stored or reflected XSS in the browser and execute arbitrary script in the user's session.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Topic data returned by /generate_topics is inserted into item.innerHTML using topic.title, difficulty, and traffic_potential without sanitization. Because this content may come from an AI backend or user-influenced prompts, malicious markup could execute in the browser when topics are displayed, creating a DOM XSS path.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The root html element is explicitly marked lang="en", which imposes an English locale choice in natural-language metadata. There is no indication in this file that users can opt into another language or that the English-only setting is required for a documented region-specific purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The HTML root sets lang="en", and all visible user-facing text in the template is English-only. Under the stated policy, forcing a specific language without opt-in can be a natural-language policy violation when no language choice or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.