ClawHub
Back to skill

Security audit

YouTube SERP Scout

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent YouTube search API wrapper, but it needs Review because its client can expose the AIsa API key if authenticated requests follow redirects outside the intended API domain.

Review before installing if the AIsa API key has billing or broad account authority. Use a limited-scope or low-credit key, avoid sensitive search terms, and prefer a version that rejects cross-origin redirects or strips Authorization on redirect.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/youtube_client.py:50
Finding

Bearer API Key May Be Disclosed Through Cross-Origin HTTP Redirects

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (9)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill requires environment access for AISA_API_KEY and performs outbound network requests, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission weakens reviewability and runtime containment, making it easier for an agent platform to grant broader capabilities than intended or for users to miss that secrets will be sent to a third-party API.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This example sends an authorization bearer token and user-supplied search content to api.aisa.one, which is an external service. In context this is the skill's intended function, but it still represents a real data egress path where secrets and potentially sensitive queries leave the local agent environment.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

bash
# Search for videos
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI+agents+tutorial" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This request transmits the bearer token plus search parameters to an external endpoint. Although expected for a YouTube search integration, the pattern is still security-relevant because any sensitive search terms, tenant data, or credentials provided by the agent are exposed to a third-party service boundary.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash
# Search in specific country (US)
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=machine+learning&gl=us" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Search in Japan

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This example again causes external transmission of both authentication material and query content to api.aisa.one. The country and language parameters are low risk by themselves, but the overall request remains a data egress channel and should be treated as such.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

Search in Japan

curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI&gl=jp&hl=ja"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

This curl example performs outbound transmission to a third-party API using a bearer token from the environment. The skill context makes this expected rather than covert, but it remains a genuine security concern because it enables exfiltration of query content and misuse of the token if handling is lax.

Content

Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.

bash
# Search with interface language
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=python+tutorial&hl=en" \
  -H "Authorization: Bearer $AISA_API_KEY"

# Chinese interface

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill sends requests containing a bearer credential and user query to api.aisa.one, creating an external data flow. While aligned with the product purpose, this still increases exposure of user inputs and introduces dependency on the third party's handling of authentication and request data.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

-H "Authorization: Bearer $AISA_API_KEY"

Chinese interface

curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=编程教程&hl=zh-CN&gl=cn"
-H "Authorization: Bearer $AISA_API_KEY"

text

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The sp filter token request is another external transmission path that includes bearer authentication and potentially user-controlled parameters. If the parameter is sourced dynamically, it may broaden what data is sent externally and complicate monitoring, even though the request itself is part of normal functionality.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

bash
# Use sp parameter for pagination or advanced filters
curl "https://api.aisa.one/apis/v1/youtube/search?engine=youtube&q=AI&sp=<filter_token>" \
  -H "Authorization: Bearer $AISA_API_KEY"

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube_client.py (reported line 24)May include surrounding context.

python
class YouTubeClient:
    """OpenClaw YouTube - YouTube SERP Scout API Client."""
    
    BASE_URL = "https://api.aisa.one/apis/v1"
    
    def __init__(self, api_key: Optional[str] = None):
        """Initialize the client with an API key."""

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This code sends the user's query, country, language, and optional filter parameters to the remote AIsa API via urllib without any runtime notice beyond internal docstrings. For a code file, outbound transmission of user data should have some visible disclosure unless it is clearly surfaced to the user; here the CLI help describes search behavior but does not explicitly warn that inputs are sent to a third-party service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.