Openclaw Youtube

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:41 PM UTC
• Version:
  1.0.0

Overview

This skill is a straightforward YouTube research helper that uses an AIsa API key to call AIsa’s service and return public YouTube search results.

Install only if you are comfortable giving this skill an AISA_API_KEY and sending your YouTube search queries to AIsa. Use a scoped or dedicated key where possible, rotate it if exposed, and review API usage if the skill is used heavily.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares access to an API key and invokes a Python script that will likely make outbound network requests, but it does not explicitly declare permissions for environment-variable and network use. This creates a transparency and governance gap: hosts or users may invoke the skill without understanding that secrets are read from the environment and sent to an external service, increasing the risk of unintended secret exposure or unreviewed external data egress.

VirusTotal

67/67 vendors flagged this skill as clean.