ClawHub
Back to skill

Security audit

Youtube Outlier Skill

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its YouTube reporting purpose, but it automatically writes/posts externally and under-discloses an Anthropic analysis path, so it should be reviewed before installation.

Install only after you are comfortable with the configured Google Sheet and Discord channel receiving the report automatically. Use tightly scoped service-account and bot permissions, update/audit dependencies, add a real dry-run or confirmation path, disclose or disable the Anthropic call, and sanitize/limit Discord output with mentions disabled.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T01 · Skill Instruction Hijacking

Warning
Location
youtubeUtils.ts:70
Finding

Indirect Prompt Injection Through Untrusted YouTube Metadata

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
youtubeUtils.ts:31
Finding

YouTube API Key Embedded in Request Query Strings

Content
View full analysis
item.id.videoId).join(','); // 2. Fetch video stats (views, published date) const detailsUrl = `https://www.googleapis.com/youtube/v3/videos?part=snippet,statistics&id=${videoIds}&key=${API_KEY}`; const detailsRes = await axios.get(detailsUrl); ``` ### Technical Analysis The YouTube API key is included in complete URL strings as the `key` query parameter. This is part of Google’s supported API authentication model and the requests use HTTPS, so the key is not transmitted in plaintext on the network under normal TLS operation. However, URLs are frequently retained by application logs, reverse proxies, HTTP instrumentation, exception telemetry, tracing systems, and debugging tools. If Axios errors or full request configurations are recorded, the API key may be exposed to users or systems with access to those records. The destination is the official Google API. No evidence indicates that the key is sent to an attacker-controlled endpoint. ### Attack Path 1. The Skill constructs a YouTube API URL containing `YOUTUBE_API_KEY`. 2. A request fails, is traced, or passes through infrastructure that logs complete URLs. 3. The credential-bearing query string is stored in logs or telemetry. 4. An attacker or unauthorized operator obtains access to those records. 5. The exposed key is reused against enabled Google APIs, subject to the key’s restrictions and quotas. ### Impact Assessment A disclosed key could permit unauthorized YouTube Data API requests, quota consumption, une ...[truncated 362 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Note
Location
index.ts:72
Finding

Untrusted Report Content Sent to Discord Without Mention Controls

Content
View full analysis
`${r[1]} | ${r[3]} | ${r[2]}`).join('\n'); (channel as TextChannel).send(msg); } ``` ### Technical Analysis The message contains a user-provided niche, YouTube-controlled titles and URLs, and Anthropic-generated summaries. These values are inserted directly into a Discord message without escaping Discord markup or disabling mention parsing. A malicious title, niche, or model-generated summary may contain user, role, or mass-mention syntax. Discord can interpret that syntax when the bot sends the message. Whether a notification is generated depends on Discord permissions, server configuration, and the referenced identifiers. The same output can also contain misleading formatting, links, or markdown that makes an attacker-controlled report appear authoritative. ### Attack Path 1. An attacker places Discord mention syntax or deceptive markup in a YouTube title or description. 2. Alternatively, an attacker uses indirect prompt injection to make the Anthropic response contain such syntax. 3. The targeted video is selected by the Skill as an outlier. 4. The title and generated main idea are inserted into the report without sanitization. 5. The Discord bot sends the message without an `allowedMentions` restriction. 6. Discord parses the content and may notify users or roles allowed by the bot’s permissions. A user invoking the CLI or API may also supply a crafted `niche` value that contributes markup or mention syntax to the report heading. ### Impact Assessment Successful exploitation may cause unwanted user, role, or mass notifications, deceptive message formatting, or publication of attacker-controlled li ...[truncated 356 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (26)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

ending YouTube videos by niche keyword, analyzes main concepts, and stores to Google Sheet. Posts summary to Discord.

Parameters Supported

  • niche (single or comma-separated list)

Usage

Via Discord or API call:

text
/ytoutlier AI news

Discord Command Registration

Add to your Discord/OpenClaw config, or copy below to your skill manifest:

yaml
commands:
  - name: ytoutlier
    description: Find trending YouTube outlier videos in a niche.
    usage: /ytoutlier <niche>
    handler: youtube-outlier-skill

Requirements

  • Google Sheets API credentials (edit access to your target sheet)
  • Discord bot token and channel ID
  • YouTube Data API key (if not handled by youtube-api-skill)

Environment variables

See .env.example for all required variables.

Skill created for Danny by Soma 🧘‍♂️ (OpenClaw)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · index.ts (reported line 6)May include surrounding context.

ts
import { getYoutubeOutlierVideos, extractVideoMetadata } from './youtubeUtils'; // <-- implement these helpers
import dotenv from 'dotenv';

dotenv.config({ path: __dirname + '/.env' });

// Environment vars
const SHEET_ID = process.env.GOOGLE_SHEET_ID;

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
96% confidence
Finding

The lockfile pins axios 1.13.6, and the supplied advisories include high-risk issues such as SSRF-related proxy bypass and prototype-pollution-assisted credential or response compromise. In this skill context, axios is a top-level dependency and is likely used for outbound API access, which increases the relevance of SSRF, header handling, and redirect/proxy issues.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High
Category
Supply Chain
Confidence
85% confidence
Finding

brace-expansion 2.0.2 is reported with multiple denial-of-service issues involving pathological expansion input. Although it is a transitive utility dependency rather than application logic, a vulnerable parser in the dependency tree can still be abused if attacker-controlled patterns ever reach it during file/path processing or tooling execution.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
87% confidence
Finding

form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names/filenames. If this skill uploads files or forwards user-supplied metadata to external APIs, an attacker may be able to manipulate multipart boundaries or inject unexpected headers/content into outbound requests.

Content

No source excerpt is available for this finding.

Possible Typosquatting: 'gaxios' resembles popular package 'axios'

High
Category
Supply Chain
Confidence
70% confidence
Finding

Package name closely resembles a popular package, suggesting possible typosquatting. Attackers publish malicious packages with similar names to trick developers into installing them.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: lodash==4.17.23 — 2 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names)

High
Category
Supply Chain
Confidence
88% confidence
Finding

lodash 4.17.23 is associated with known prototype pollution and code-injection history. Here it appears as a transitive dependency of @sapphire/shapeshift rather than a directly used package, which reduces immediate exploitability, but prototype pollution remains dangerous if untrusted objects or path expressions can flow into affected functions.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: undici==6.21.3 — 13 advisory(ies): CVE-2026-1525 (Undici has an HTTP Request/Response Smuggling issue); CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-1527 (Undici has CRLF Injection in undici via `upgrade` option) +10 more

High
Category
Supply Chain
Confidence
95% confidence
Finding

undici 6.21.3 is flagged for multiple high-severity HTTP parsing and request/response handling issues including smuggling, queue poisoning, and CRLF-related problems. This is especially relevant because the skill depends on network-heavy libraries like discord.js and Google/OpenAI clients, so malformed upstream or intermediary traffic could have meaningful security impact.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ws==8.19.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)

High
Category
Supply Chain
Confidence
90% confidence
Finding

ws 8.19.0 is reported vulnerable to memory disclosure and memory-exhaustion conditions. Because discord.js relies on websocket connectivity, a flaw in ws can be relevant in a long-lived bot or agent process, particularly if it maintains persistent connections and processes high volumes of fragmented frames.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
98% confidence
Finding

The manifest includes axios 1.13.6, which the finding identifies as affected by multiple known advisories, including SSRF- and MITM-related issues. Because this skill also depends on network-facing libraries and likely performs outbound HTTP requests, a vulnerable HTTP client can materially increase the risk of request smuggling, proxy bypass, credential leakage, or response tampering depending on how axios is used elsewhere in the project.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The README explicitly describes sending collected YouTube-derived data to external services like Google Sheets and Discord, but it does not warn users about data disclosure, retention, or privacy implications. In an agent skill context, silent exfiltration to third-party platforms is security-relevant because users may invoke the skill assuming local analysis, while transcripts, metadata, or summaries are being transmitted off-platform.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill description states that it stores results to Google Sheets and posts summaries to Discord, but it does not clearly warn users up front that invoking the skill causes external writes and message posting. This can lead to unintended data disclosure, unwanted side effects, or misuse in environments where users expect read-only analysis rather than outbound actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The code reads Google Sheets credentials from an environment variable and uses them to authenticate, but there is no user-facing disclosure, confirmation, or explanatory comment warning that sensitive credentials are being accessed. Under the code-file criteria, access to sensitive environment variables should have some visible warning unless clearly disclosed elsewhere in the skill description, which is not present in this file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The code advertises a dry-run path but hard-codes DRY_RUN = false, guaranteeing that execution will write to Google Sheets and post to Discord. In an agent skill context, this can mislead operators into believing the action is non-destructive or preview-only, increasing the risk of unintended data disclosure and external side effects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill appends collected data to a Google Sheet without any explicit user disclosure or confirmation at runtime. In an agent environment, silent transmission of processed content to third-party storage can expose sensitive or proprietary information and violates least-surprise expectations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The code posts a summary containing titles, ideas, and thumbnail URLs to Discord without explicit user awareness or consent. This creates a data-exfiltration path to an external chat platform, which is more dangerous in a skill because users may not expect content to be redistributed beyond the immediate task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The function sends video title, description, and potentially transcript content to Anthropic, which is a third-party AI provider, without any visible consent, disclosure, minimization, or policy enforcement. If transcripts later include private, copyrighted, or regulated content, this creates a data-sharing/privacy risk and may violate user expectations or compliance requirements.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
80% confidence
Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. In this project, it is pulled in via axios, so any code that follows redirects while sending bearer tokens, API keys, or cookies could unintentionally disclose credentials to attacker-controlled endpoints.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low
Category
Supply Chain
Confidence
78% confidence
Finding

qs 6.15.0 is flagged for several denial-of-service issues. In this skill, qs arrives through googleapis-common, so the practical risk depends on whether attacker-controlled query structures are serialized or parsed; absent that, the issue is real but likely lower impact than network-facing direct dependencies.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 3)May include surrounding context.

json
{
  "dependencies": {
    "axios": "^1.13.6",
    "discord.js": "^14.25.1",
    "dotenv": "^17.3.1",
    "googleapis": "^171.4.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json
{
  "dependencies": {
    "axios": "^1.13.6",
    "discord.js": "^14.25.1",
    "dotenv": "^17.3.1",
    "googleapis": "^171.4.0",
    "openai": "^6.25.0"

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 5)May include surrounding context.

json
"dependencies": {
    "axios": "^1.13.6",
    "discord.js": "^14.25.1",
    "dotenv": "^17.3.1",
    "googleapis": "^171.4.0",
    "openai": "^6.25.0"
  },

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 6)May include surrounding context.

json
"axios": "^1.13.6",
    "discord.js": "^14.25.1",
    "dotenv": "^17.3.1",
    "googleapis": "^171.4.0",
    "openai": "^6.25.0"
  },
  "devDependencies": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 7)May include surrounding context.

json
"discord.js": "^14.25.1",
    "dotenv": "^17.3.1",
    "googleapis": "^171.4.0",
    "openai": "^6.25.0"
  },
  "devDependencies": {
    "ts-node": "^10.9.2",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 10)May include surrounding context.

json
"openai": "^6.25.0"
  },
  "devDependencies": {
    "ts-node": "^10.9.2",
    "typescript": "^5.9.3"
  }
}

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
index.ts:9

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
youtubeUtils.ts:24