ClawHub
Back to skill

Security audit

yt-mem-ai

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent YouTube workflow helper, but it tells the agent to persistently enable browser-cookie access for YouTube fetches without clear user-controlled scoping.

Install only if you are comfortable with an agent running the external yt-mem-ai CLI and storing YouTube-related configuration globally. Before enabling YT_COOKIES_BROWSER, use a dedicated browser profile or account if possible, confirm the agent should use that session, and unset the setting when no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
| Error | Cause | Fix |
|---|---|---|
| `YouTube bot check: ... Sign in to confirm you're not a bot` (exit 4) | yt-dlp (audio/metadata) needs a logged-in session | `uvx yt-mem-ai config set YT_COOKIES_BROWSER chrome` (or `brave`/`firefox`/`edge`/`safari`), then re-run |
| `captions blocked by YouTube (IP rate-limited)` (exit 3) | the transcript API is IP-blocked | cookies do **not** help — retry later, or set `YT_CAPTIONS_USE_WEBSHARE true` + `WEBSHARE_PROXY_USERNAME`/`WEBSHARE_PROXY_PASSWORD` |
| `no captions available` (exit 1) | video has no caption track | re-run with `--whisper` (downloads audio, slower) |
Confidence
85% confidence
Finding
COOKIES_BROWSER chrome` (or `brave`/`firefox`/`edge

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.