ClawHub
Back to skill

Security audit

YouTube Digest

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned for YouTube transcript extraction and summaries, but its documented dependency installation uses unverified remote code and system-wide writes that deserve review before installation.

Review before installing. Prefer a package manager or pinned, checksum-verified yt-dlp and Deno versions, avoid curl-to-sh and broad sudo installs, run the skill with only the needed network and filesystem access, write outputs to a dedicated directory, and treat all video-derived transcript text as untrusted content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T03 · Remote Payload Retrieval and Execution

Error
Location
README.md:49
Finding

Remote Installer Is Executed Directly Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
README.md:44
Finding

Unpinned System-Wide yt-dlp Binary Is Installed Without Integrity Verification

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
SKILL.md:14
Finding

Untrusted YouTube Subtitle Content Is Read by the Agent Without Prompt-Injection Isolation

Content
View full analysis
" in line: continue if re.match(r"^\d{2}:\d{2}[:.]\d{2}", line): continue if line.startswith("NOTE") or line.startswith("Kind:") or line.startswith("Language:"): continue line = re.sub(r"<[^>]+>", "", line) line = re.sub(r" ", " ", line) line = re.sub(r"\s+", " ", line).strip() if line: text_lines.append(line) text_lines = dedupe_keep_order(text_lines) txt_path.w ...[truncated 2679 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The implemented code is narrowly focused on metadata retrieval and subtitle/transcript extraction from YouTube via yt-dlp. That aligns with only one part of the declared description: transcript/subtitle extraction in a transcript-first workflow. However, the declared purpose substantially overstates the skill's capabilities by claiming summarization, translation, timestamp/chapter generation, visual understanding, and QA over video content, none of which are present in this code chunk. There is no video download or frame analysis, no NLP summarization or translation logic, and no QA interface. Therefore the description does not accurately represent the actual behavior of this supplied code chunk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

bash
# yt-dlp
sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod +x /usr/local/bin/yt-dlp

# deno

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

bash
# yt-dlp
sudo curl -L https://github.com/yt-dlp/yt-dlp/releases/latest/download/yt-dlp -o /usr/local/bin/yt-dlp
sudo chmod +x /usr/local/bin/yt-dlp

# deno

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
96% confidence
Finding

The skill instructs use of shell commands, network access, and reading/writing local files, but it declares no explicit tool scope or permission boundaries. In an agent environment, that gap can let the skill run with broader-than-necessary capabilities, increasing the chance of unintended downloads, filesystem access, or command execution beyond the user’s expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill hard-codes Chinese as the output language for the 'Quick Chinese summary' workflow without indicating that this should be conditioned on user preference or locale. This can cause the agent to ignore the user's requested language, leading to unintended disclosure or usability issues in multilingual contexts, though it is not a direct code-execution or data-exfiltration risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The translation guidance defaults parts of long-video output to Chinese ('中文摘要', '关键段落精译') without first checking the user's target language. In a translation skill, hard-coded language defaults can override user intent and produce incorrect or policy-misaligned outputs, especially for users expecting another language.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/fetch_youtube.py (reported line 12)May include surrounding context.

python
def run(cmd):
    proc = subprocess.run(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE, text=True)
    return proc.returncode, proc.stdout, proc.stderr

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The script creates output directories and writes transcript.txt and summary.json without an explicit upfront notice that it will modify the filesystem. In an agent skill, undisclosed file creation can surprise users, overwrite expected workspace contents, or expose sensitive transcript data if written to shared locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The script performs outbound network requests to YouTube via yt-dlp using user-supplied input, but does not provide any explicit user-facing notice that external requests and metadata transmission will occur. In an agent/skill context, this can create privacy and consent issues because invoking the skill causes network access to third-party services and may leak the requested URL, IP/proxy usage, and request metadata.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.