ClawHub
Back to skill

Security audit

Dataify YouTube Comment By ID

Security checks across malware telemetry and agentic risk

Overview

This skill coherently submits user-confirmed YouTube comment collection jobs to Dataify and does not show hidden or unrelated behavior.

Install only if you are comfortable letting the skill use a Dataify API TOKEN from your environment or one you provide, and creating Dataify Builder tasks for the YouTube video IDs you confirm.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill explicitly instructs the agent to access a locally saved environment variable (`DATAIFY_API_TOKEN`) and to make outbound network requests, but no declared permissions are present to signal or constrain those capabilities. This creates a transparency and consent problem: a user may invoke a data collection skill without realizing it can read local secrets and contact an external service.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The skill enables implicit invocation (`allow_implicit_invocation: true`) while its activation scope is broad and driven by natural-language requests such as collecting or scraping YouTube comments, including troubleshooting and token configuration. This increases the chance the agent will trigger the skill without an explicit user confirmation, potentially causing unintended external API actions, data collection, or token-related workflow execution.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
- If the user provides a token in the request, use it for this run.
- If no token is provided, first check whether `DATAIFY_API_TOKEN` is already saved locally in the environment.
- If `DATAIFY_API_TOKEN` is saved locally, use it without asking the user to re-enter the token.
- If no token is available locally, tell the user they need to provide a Dataify API TOKEN.
- If the user does not have an API TOKEN, tell them they can register or log in at [Dataify](https://dashboard.dataify.com/login?utm_source=skill) to get one.
- If the user already has an API TOKEN, tell them it is available in the top-right area of [Dataify](https://dashboard.dataify.com?utm_source=skill).
Confidence
92% confidence
Finding
without asking

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.