ClawHub
Back to skill

Security audit

follow-aibuilders

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent digest purpose, but it needs review because it can use browser cookies, fetch arbitrary blog URLs, and write prompt files without enough containment.

Review before installing. Use it only in a low-privilege environment, avoid setting YT_DLP_COOKIES=chrome unless you accept yt-dlp accessing browser session cookies, do not add localhost/private-network blog URLs, and avoid passing API keys on the command line. Regenerate or audit the npm lockfile before running npm install.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)

T01 · Skill Instruction Hijacking

Error
Location
prompts/digest-intro.md:58
Finding

Mandatory Promotional Output Injection

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/cli.js:377
Finding

Arbitrary File Read and Write Through Prompt Name Path Traversal

Content
View full analysis
'); } const name = args[0]; const filename = name.endsWith('.md') ? name : `${name}.md`; const localPath = join(PROMPTS_DIR, filename); if (!existsSync(localPath)) { error(`Prompt not found: ${name}`); } const content = await readFile(localPath, 'utf-8'); success({ name, source: 'local', content }); } async function cmdSetPrompt() { const args = process.argv.slice(3); if (args.length < 2) { error('Usage: cli.js set-prompt '); } const [name, ...contentArgs] = args; const content = contentArgs.join(' '); const filename = name.endsWith('.md') ? name : `${name}.md`; const localPath = join(PROMPTS_DIR, filename); await writeFile(localPath, content); success({ message: 'Prompt saved successfully', path: localPath }); } ``` ### Technical Analysis The prompt name is accepted directly from the command line and passed to `path.join()` without an allowlist or containment check. `path.join()` normalizes traversal segments but does not guarantee that the resulting path remains under `PROMPTS_DIR`. For example, a name such as `../../target.md` resolves outside the prompt directory. The `get-prompt` operation can read such a file, while `set-prompt` can overwrite it if the Node.js process has sufficient filesystem permissions. The `.md` suffix handling limits the most direct form of exploitation to paths ending in `.md`, but this still includes project documentation, Agent instruction files, and other Markdown files accessible to the process. ### Attack Path 1. An attacker or manipulated Agent supplies a traversal-bearing prompt name such as `../../SKILL.md`. 2. `cmdGetPrompt` ...[truncated 679 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/fetch-and-prepare.js:397
Finding

Server-Side Request Forgery Through Unrestricted Blog Source URLs

Content
View full analysis
Remediation
View remediation

T01 · Skill Instruction Hijacking

Warning
Location
scripts/fetch-and-prepare.js:547
Finding

Indirect Prompt Injection Through Untrusted Feed Content

Content
View full analysis
sum + a.tweets.length, 0), blogPosts: blogContent.length }, prompts, errors: errors.length > 0 ? errors : undefined }; ``` `SKILL.md` then instructs the Agent to read the resulting JSON and follow the embedded prompt fields while summarizing the tweets, transcripts, and blog contents. ### Technical Analysis Tweets, biographies, transcript text, article titles, and scraped article bodies are attacker-influenced external data. They are stored verbatim in the same JSON object as trusted prompt templates. The Skill does not clearly delimit external fields as inert data or instruct the Agent never to follow commands embedded in source content. An attacker can therefore publish content resembling higher-priority instructions, such as commands t ...[truncated 1622 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/cli.js:106
Finding

Twitter API Key Exposed Through Process Arguments and Weak Plaintext Storage

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
scripts/package-lock.json:479
Finding

Dependency Lockfile Uses a Third-Party Package Registry Mirror

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (60)

Known Vulnerable Dependency: form-data==4.0.0 — 2 advisory(ies): CVE-2025-7783 (form-data uses unsafe random function in form-data for choosing boundary); CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Critical
Category
Supply Chain
Confidence
95% confidence
Finding

The nested rettiwt-core dependency pins form-data 4.0.0, which is flagged for both unsafe boundary generation and CRLF injection issues. Because this skill aggregates data from external services and relies on third-party API tooling, a vulnerable multipart implementation in a transitive dependency increases the attack surface for request tampering, boundary prediction, or malformed outbound requests if multipart features are exercised.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 27)May include surrounding context.

��有原始内容的链接

  • 支持英文、中文或双语版本

前置要求

系统依赖

yt-dlp（YouTube 视频列表和字幕获取）

  • macOS: brew install yt-dlp
  • Linux: pip install yt-dlp 或 pipx install yt-dlp
  • Windows: pip install yt-dlp 或从 GitHub Releases 下载
  • 如遇到 "Sign in to confirm" 错误，需配置 cookies：在 .env 添加 YT_DLP_COOKIES=chrome

Node.js 22+（Rettiwt-API 依赖要求）

Twitter/X：无需 API key，使用免费 guest 认证。如果遇到限流，可配置 user 认证（可选）。

快速开始

  1. 在你的 AI agent 中安装此 skill（OpenClaw 或 Claude Code）
  2. 确保已安装 yt-dlp：
    bash
    yt-dlp --version
  3. （可选）如需 Twitter user 认证，添加到 .env：
    bash
    RETTIWT_API_KEY=your_key_here
  4. 输入 "set up follow builders" 或执行 /follow-builders
  5. Agent 会以对话方式引导你完成设�

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The skill also supports blog scraping, prompt loading for downstream LLM processing, dedup/state management, and user-defined sources, which broadens data collection and execution beyond the stated X/YouTube digest behavior. Hidden expansion of collection scope is risky because users may not realize external websites are fetched and locally stored/processed.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
89% confidence
Finding

The skill also supports blog scraping, prompt loading for downstream LLM processing, dedup/state management, and user-defined sources, which broadens data collection and execution beyond the stated X/YouTube digest behavior. Hidden expansion of collection scope is risky because users may not realize external websites are fetched and locally stored/processed.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 66)May include surrounding context.

key]

text

如果用户没有 API key（大多数情况），直接运行不带参数：

```bash
cd ${CLAUDE_SKILL_DIR}/scripts && node cli.js setup-env

自动检测 yt-dlp 是否已安装：

bash
yt-dlp --version

如果未安装，指导用户安装后再继续。

如果 yt-dlp 报错"Sign in to confirm you're not a bot"，需要配置 cookies： 在 .env 中添加：

text
YT_DLP_COOKIES=chrome

（支持 chrome、firefox、edge 等浏览器名，或 cookies.txt 文件路径）

Step 2: 介绍

告诉用户：

"我是你的 AI Builders Digest。我追踪 AI 领域的顶级 builders —— 正在构建产品的研究人员、创始人、产品经理和工程师 —— 跨越 X/Twitter 和 YouTube 播客。我可以为你提供他们观点、想法和工作的精选摘要。"

bash
cd ${CLAUDE_SKILL_DIR}/scripts && node cli.js get-default-sources

从输出中读取源数量，然后告诉用户：

"我目前默认追踪 [N] 个 X 上的 builders、[M] �

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
75% confidence
Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/cli.js (reported line 129)May include surrounding context.

js
key]
```

如果用户没有 API key（大多数情况），直接运行不带参数：

```bash
cd ${CLAUDE_SKILL_DIR}/scripts && node cli.js setup-env
```

自动检测 yt-dlp 是否已安装：

```bash
yt-dlp --version
```

如果未安装，指导用户安装后再继续。

如果 yt-dlp 报错"Sign in to confirm you're not a bot"，需要配置 cookies：
在 `.env` 中添加：
```
YT_DLP_COOKIES=chrome
```
（支持 chrome、firefox、edge 等浏览器名，或 cookies.txt 文件路径）

### Step 2: 介绍

告诉用户：

"我是你的 AI Builders Digest。我追踪 AI 领域的顶级 builders —— 正在构建产品的研究人员、创始人、产品经理和工程师 —— 跨越 X/Twitter 和 YouTube 播客。我可以为你提供他们观点、想法和工作的精选摘要。"

```bash
cd ${CLAUDE_SKILL_DIR}/scripts && node cli.js get-default-sources
```

从输出中读取源数量，然后告诉用户：

"我目前默认追踪 [N] 个 X 上的 builders、[M] �

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · digest-data.json (reported line 39)May include surrounding context.

json
on my experience.",
          "createdAt": "Fri Apr 17 01:26:48 +0000 2026",
          "url": "https://x.com/petergyang/status/2044950675046678954",
          "likes": 30,
          "retweets": 3,
          "replies": 13,
          "isQuote": false,
          "quotedTweetId": null
        },
        {
          "id": "2044791642432172121",
          "text": "What is the sweet spot in open source model size? Are 35B models enough for local agentic workflows?\n\nTrying to decide how much RAM I need in a new computer.",
          "createdAt": "Thu Apr 16 14:54:52 +0000 2026",
          "url": "https://x.com/petergyang/status/2044791642432172121",
          "likes": 67,
          "retweets": 3,
          "replies": 62,
          "isQuote": true,
          "quotedTweetId": "2044768734234243427"
        }
      ]
    },
    {
      "source": "x",
      "name": "Nan Yu",
      "handle": "thenanyu",
      "bio": "head of product @linear",
      "tweets": [
        {
          "id": "204492189

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · digest-data.json (reported line 212)May include surrounding context.

json
"publishedAt": null,
      "author": "",
      "description": "",
      "content": "Get started with Claude Managed Agents by following our docs . A running topic on the Engineering Blog is how to build effective agents and design harnesses for long-running work . A common thread across this work is that harnesses encode assumptions about what Claude can’t do on its own. However, those assumptions need to be frequently questioned because they can go stale as models improve. As just one example, in prior work we found that Claude Sonnet 4.5 would wrap up tasks prematurely as it sensed its context limit approaching—a behavior sometimes called “context anxiety.” We addressed this by adding context resets to the harness. But when we used the same harness on Claude Opus 4.5, we found that the behavior was gone. The resets had become dead weight. We expect harnesses to continue evolving. So we built Managed Agents: a hosted service in the Claude Platform that runs long-horizon agents on your behalf through a small set of interfaces meant to outlast any particular implementation—including the ones we run today. Building Managed Agents meant solving an old problem in computing: how to design a system for “ programs as yet unthought of .” Decades ago, operating systems solved this problem by virtualizing hardware into abstractions— process, file —general enough for programs that didn&#x27;t exist yet. The abstractions outlasted the hardware. The read() command is agnostic as to whether it’s accessing a disk pack from the 1970s or a modern SSD. The abstractions on top stayed stable while the implementations underneath changed freely. Managed Agents follow the same pattern. We virtualized the components of an agent: a session (the append-only log of everything that happened), a harness (the loop that calls Claude and routes Claude’s tool calls to the relevant infrastructure), and a sandbox (an execution environment where Claude can run code and edit files). This allows the imp
...[truncated 27 chars]

Instruction Override

High
Category
Prompt Injection
Confidence
80% confidence
Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · digest-data.json (reported line 222)May include surrounding context.

json
"publishedAt": null,
      "author": "",
      "description": "",
      "content": "By default, Claude Code asks users for approval before running commands or modifying files. This keeps users safe, but it also means a lot of clicking \"approve.\" Over time that leads to approval fatigue, where people stop paying close attention to what they&#x27;re approving. Users have two solutions for avoiding this fatigue: a built-in sandbox where tools are isolated to prevent dangerous actions, or the --dangerously-skip-permissions flag that disables all permission prompts and lets Claude act freely, which is unsafe in most situations. Figure 1 lays out the tradeoff space. Sandboxing is safe but high-maintenance: each new capability needs configuring, and anything requiring network or host access breaks isolation. Bypassing permissions is zero-maintenance but offers no protection. Manual prompts sit in the middle, and in practice users accept 93% of them anyway. Figure 1. The permission modes available in Claude Code, positioned by task autonomy and security . Dot colour indicates maintenance friction. Auto mode targets high autonomy at low maintenance cost; the dashed arrow shows security improvement over time as classifier coverage and model judgment get better. We keep an internal incident log focused on agentic misbehaviors. Past examples include deleting remote git branches from a misinterpreted instruction, uploading an engineer&#x27;s GitHub auth token to an internal compute cluster, and attempting migrations against a production database. Each of these was the result of the model being overeager, taking initiative in a way the user didn&#x27;t intend. We documented this pattern in the Claude Opus 4.6 system card (§6.2.1 and §6.2.3.3). Auto mode is a new mode for Claude Code that delegates approvals to model-based classifiers—a middle ground between manual review and no guardrails. The goal is to catch the dangerous actions that aren&#x27;t aligned with user intent, whi
...[truncated 27 chars]

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · digest-data.json (reported line 222)May include surrounding context.

json
"publishedAt": null,
      "author": "",
      "description": "",
      "content": "By default, Claude Code asks users for approval before running commands or modifying files. This keeps users safe, but it also means a lot of clicking \"approve.\" Over time that leads to approval fatigue, where people stop paying close attention to what they&#x27;re approving. Users have two solutions for avoiding this fatigue: a built-in sandbox where tools are isolated to prevent dangerous actions, or the --dangerously-skip-permissions flag that disables all permission prompts and lets Claude act freely, which is unsafe in most situations. Figure 1 lays out the tradeoff space. Sandboxing is safe but high-maintenance: each new capability needs configuring, and anything requiring network or host access breaks isolation. Bypassing permissions is zero-maintenance but offers no protection. Manual prompts sit in the middle, and in practice users accept 93% of them anyway. Figure 1. The permission modes available in Claude Code, positioned by task autonomy and security . Dot colour indicates maintenance friction. Auto mode targets high autonomy at low maintenance cost; the dashed arrow shows security improvement over time as classifier coverage and model judgment get better. We keep an internal incident log focused on agentic misbehaviors. Past examples include deleting remote git branches from a misinterpreted instruction, uploading an engineer&#x27;s GitHub auth token to an internal compute cluster, and attempting migrations against a production database. Each of these was the result of the model being overeager, taking initiative in a way the user didn&#x27;t intend. We documented this pattern in the Claude Opus 4.6 system card (§6.2.1 and §6.2.3.3). Auto mode is a new mode for Claude Code that delegates approvals to model-based classifiers—a middle ground between manual review and no guardrails. The goal is to catch the dangerous actions that aren&#x27;t aligned with user intent, whi
...[truncated 27 chars]

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The normalized match variant still points to browser-cookie acquisition instructions for yt-dlp. Because these cookies originate from end-user browsers, using them in an agent skill creates a strong possibility of secret over-collection and unintended account access.

Content

Scanner excerpt · digest-data.json (reported line 256)May include surrounding context.

json
"X API: Error fetching @adityaag: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @sama: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The normalized match variant still points to browser-cookie acquisition instructions for yt-dlp. Because these cookies originate from end-user browsers, using them in an agent skill creates a strong possibility of secret over-collection and unintended account access.

Content

Scanner excerpt · digest-data.json (reported line 256)May include surrounding context.

json
"X API: Error fetching @adityaag: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @sama: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The normalized match variant still points to browser-cookie acquisition instructions for yt-dlp. Because these cookies originate from end-user browsers, using them in an agent skill creates a strong possibility of secret over-collection and unintended account access.

Content

Scanner excerpt · digest-data.json (reported line 256)May include surrounding context.

json
"X API: Error fetching @adityaag: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @sama: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Confidence
96% confidence
Finding

The YARA 'info_stealer' hit is justified here because the file endorses pulling cookies from local browsers or cookie files into configuration. While not overt malware, this is still a credential-harvesting-adjacent pattern that could expose sensitive browser session tokens if followed.

Content

Scanner excerpt · digest-data.json (reported line 256)May include surrounding context.

json
ent network socket disconnected before secure TLS connection was established",
    "X API: Error fetching @adityaag: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @sama: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp �

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This is another duplicated normalized instance of the same unsafe pattern. The content-digest use case does not justify instructing operators to export or reference browser cookies from local browsers.

Content

Scanner excerpt · digest-data.json (reported line 257)May include surrounding context.

json
"X API: Error fetching @sama: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This is another duplicated normalized instance of the same unsafe pattern. The content-digest use case does not justify instructing operators to export or reference browser cookies from local browsers.

Content

Scanner excerpt · digest-data.json (reported line 257)May include surrounding context.

json
"X API: Error fetching @sama: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This is another duplicated normalized instance of the same unsafe pattern. The content-digest use case does not justify instructing operators to export or reference browser cookies from local browsers.

Content

Scanner excerpt · digest-data.json (reported line 257)May include surrounding context.

json
"X API: Error fetching @sama: Cannot read properties of undefined (reading '0')",
    "X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt"

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This line again promotes importing browser authentication material into the agent environment. Such material can often be replayed and may expose broader Google/YouTube account scope than intended.

Content

Scanner excerpt · digest-data.json (reported line 258)May include surrounding context.

json
"X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"
  ]

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This line again promotes importing browser authentication material into the agent environment. Such material can often be replayed and may expose broader Google/YouTube account scope than intended.

Content

Scanner excerpt · digest-data.json (reported line 258)May include surrounding context.

json
"X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"
  ]

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This line again promotes importing browser authentication material into the agent environment. Such material can often be replayed and may expose broader Google/YouTube account scope than intended.

Content

Scanner excerpt · digest-data.json (reported line 258)May include surrounding context.

json
"X API: Error fetching @claudeai: Cannot read properties of undefined (reading '0')",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt"
  ]

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This repeated normalized cookie instruction remains a true vulnerability for the same reason: it encourages harvesting and storing bearer tokens in configuration. The repetition suggests the pattern is systematic rather than incidental.

Content

Scanner excerpt · digest-data.json (reported line 259)May include surrounding context.

json
"YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"
  ]
}

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This repeated normalized cookie instruction remains a true vulnerability for the same reason: it encourages harvesting and storing bearer tokens in configuration. The repetition suggests the pattern is systematic rather than incidental.

Content

Scanner excerpt · digest-data.json (reported line 259)May include surrounding context.

json
"YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"
  ]
}

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

This repeated normalized cookie instruction remains a true vulnerability for the same reason: it encourages harvesting and storing bearer tokens in configuration. The repetition suggests the pattern is systematic rather than incidental.

Content

Scanner excerpt · digest-data.json (reported line 259)May include surrounding context.

json
"YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies:\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome(或 firefox/edge)\n  或指定 cookies 文件路径:YT_DLP_COOKIES=/path/to/cookies.txt"
  ]
}

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The final normalized instance reinforces a credential-handling design flaw rather than a one-off mention. For this skill's scope, the security cost of importing browser cookies outweighs the benefit of fetching otherwise unavailable YouTube content.

Content

Scanner excerpt · digest-data.json (reported line 260)May include surrounding context.

json
"YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"
  ]
}

Credential Access

High
Category
Privilege Escalation
Confidence
95% confidence
Finding

The final normalized instance reinforces a credential-handling design flaw rather than a one-off mention. For this skill's scope, the security cost of importing browser cookies outweighs the benefit of fetching otherwise unavailable YouTube content.

Content

Scanner excerpt · digest-data.json (reported line 260)May include surrounding context.

json
"YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt",
    "YouTube: yt-dlp 被要求验证身份。请配置 cookies：\n  在 data/.env 中添加 YT_DLP_COOKIES=chrome（或 firefox/edge）\n  或指定 cookies 文件路径：YT_DLP_COOKIES=/path/to/cookies.txt"
  ]
}

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.install_untrusted_source

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/yt-dlp-helpers.js:7

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/fetch-and-prepare.js:81

Install source points to URL shortener or raw IP.

Warn
Code
suspicious.install_untrusted_source
Location
digest-data.json:13