YouTube Content Manager

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:02 AM UTC
• Version: 1.0.1

Overview

This skill is a YouTube content tool, but it embeds live-looking payment and AI API keys, sends content to an undisclosed AI provider, and has unsafe billing and web-server behavior that users should review before installing.

Treat this as a Review item, not a confirmed attack. Do not install or run it with real payment or AI credentials as-is. The publisher should remove and rotate embedded keys, disclose SiliconFlow and SkillPay data flows, align billing amounts and confirmation steps, disable public debug serving, add authentication/authorization and CSRF protection, and sanitize AI/user-provided content before rendering.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (8)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/app.py:17

Finding

Hard-Coded API Credentials and Predictable Flask Session Secret

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/app.py:349

Finding

Missing Authentication and Record-Level Authorization

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: templates/index.html:275

Finding

Stored and AI-Assisted DOM Cross-Site Scripting

Content

View full analysis

{ const highScore = topic.score >= 7 ? 'high-score' : ''; html += `

${topic.title}

Difficulty: ${topic.difficulty}/10 Traffic potential: ${topic.traffic_potential}/10 Score: ${topic.score.toFixed(1)}

Select

`; }); document.getElementById('topics-container').innerHTML = html; ``` ```javascript data.titles.forEach(title => { const bestClass = title.is_best ? 'best' : ''; titlesHtml += `

${title.title} ${title.seo_score}/100

`; }); document.getElementById('titles-list').innerHTML = titlesHtml; data.tags.forEach(tag => { tagsHtml += `${tag}`; }); document.getElementById('tags-container').innerHTML = tagsHtml; const thumb = data.thumbnail; document.getElementById('thumbnail-preview').innerHTML = `

${thumb.main_text}

${thumb.sub_text}

`; ``` Stored records and analysis results are rendered through the same unsafe pattern: ```javascript html += ` ${record.topic} ...[truncated 1837 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/app.py:434

Finding

Network-Exposed Flask Debug Server

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/app.py:153

Finding

Missing CSRF Protection on State-Changing and Billable Operations

Content

View full analysis

Remediation

View remediation

other

Warning

• Location: scripts/app.py:34

Finding

Undisclosed Transmission of User Content to an External AI Provider

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:35

Finding

Unpinned and Incomplete Dependency Installation Instructions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/app.py:101

Finding

Billing Amount and Verification Logic Do Not Match the Documented Pricing Model

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This is a strong security issue because the documented behavior does not match the detected behavior: undeclared third-party AI calls, external traffic, billing inconsistencies, and hardcoded API keys materially change the trust boundary. Users may expose data to unannounced services or incur unexpected charges, while embedded secrets create immediate credential-compromise risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill advertises capabilities that imply external network use and payment processing, but it does not declare any tool scope or allowed network permissions. This weakens security review and user consent because external communication may occur without explicit, auditable declaration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Claiming that data is stored locally and is 'safe and reliable' is misleading when the same skill includes third-party payment integration and embedded payment credentials. This can cause users to underestimate data exposure and operational risk, especially if payment or content data is transmitted off-device.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The phrase "全中文界面" indicates the skill is restricted to Chinese, and the file does not mention any user opt-in, alternative locales, or justification for a locale-specific limitation. This is a natural-language language/locale policy concern because it imposes a specific language by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The markdown describes payment handling and external API usage without clearly warning users about credential handling, third-party transmission, and the resulting privacy and financial risk. In a content-management skill, this is more dangerous because users may submit unpublished scripts, channel strategy, or other sensitive business data to external services without informed consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

A live external API endpoint is paired with a hardcoded secret key in source code. Hardcoded credentials are a serious vulnerability because anyone with code access can reuse the key for unauthorized API consumption, billing abuse, or data exfiltration through the linked third-party service.

Content

Scanner excerpt · scripts/app.py (reported line 35)May include surrounding context.

python

# 硅基流动API配置
SILICONFLOW_API_KEY = 'sk-ggfjehtmwgthcdyajhpipxhurytmnmqsnvpfzoripdgdmzar'
SILICONFLOW_API_URL = 'https://api.siliconflow.cn/v1/chat/completions'
AI_MODEL = 'Doubao-ai/doubao-seed-v2-18k'

# 调用硅基流动API函数

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

User-supplied content such as niche and topic titles is sent to an external AI provider without any visible notice, consent, or data-handling disclosure. This creates privacy and compliance risk because users may unknowingly transmit sensitive business plans, unpublished content ideas, or other private data to a third party.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

This endpoint transmits user-derived prompts to an external AI service. In this skill context, external AI use is expected, but it remains a security/privacy issue because there is no consent, minimization, or secret management, and the transmitted content may include sensitive unpublished content plans.

Content

Scanner excerpt · scripts/app.py (reported line 51)May include surrounding context.

python

'max_tokens': 4000
    }
    try:
        response = requests.post(SILICONFLOW_API_URL, headers=headers, json=payload, timeout=60)
        if response.status_code == 200:
            return response.json()['choices'][0]['message']['content']
        else:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The code performs payment-related network charges in the background through charge_user and billing middleware without a clear user-facing warning at the time of charge. Automatic charging on ordinary page access increases the risk of surprise billing and user harm, especially given the pricing inconsistency elsewhere in the skill.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The code sends billing requests to an external payment API using a hardcoded API key and triggers them during request processing. External billing transmission is highly sensitive because it can directly affect user funds and, in this app, occurs without strong transparency or explicit confirmation.

Content

Scanner excerpt · scripts/app.py (reported line 115)May include surrounding context.

python

if TEST_MODE:
        return {"ok": True, "balance": 1000}
    try:
        resp = requests.post(f"{BILLING_URL}/charge", headers=HEADERS, json={
            "user_id": user_id, "skill_id": SKILL_ID, "amount": 0,
        }, timeout=10)
        data = resp.json()

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill metadata says each invocation costs 0.001 USDT, but the code implements a different billing flow: a charge request with amount 0 plus a separate payment-link flow requesting amount 8. This mismatch can mislead users about what they will be charged and is especially risky because billing is enforced automatically in before_request.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 83% confidence

Finding

The skill requests an external payment link and redirects the user to it, which is normal for payment workflows, but the behavior is security-relevant because it is part of a hidden paywall flow and uses hardcoded secrets. Users may be redirected into payment steps that are not adequately disclosed by the skill description.

Content

Scanner excerpt · scripts/app.py (reported line 146)May include surrounding context.

python

if TEST_MODE:
        return redirect(url_for('index', test_payment='success'))
    try:
        resp = requests.post(f"{BILLING_URL}/payment-link", headers=HEADERS, json={
            "user_id": user_id, "amount": 8,
        }, timeout=10)
        payment_url = resp.json().get("payment_url")

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The document declares lang="zh-CN" and presents the page title and interface text exclusively in Chinese, which imposes a specific language/locale on users. There is no visible opt-in, language selector, or documentation indicating this is a region-specific tool with a justified locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The HTML declares lang="zh-CN" and all visible user-facing text is in Chinese, which imposes a specific language/locale on users. There is no indication in the template that this is optional, user-selected, or justified as a region-specific tool, so it matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill presents itself as a YouTube content manager, but it also contains a first-class paywall and billing gate that is not clearly disclosed in the stated functionality. While payment itself is not inherently malicious, hiding or downplaying this behavior can cause deceptive operation and unexpected user charges.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.