ClawHub
Back to skill

Security audit

Dataify YouTube Profiles

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed wrapper for submitting user-directed YouTube profile collection jobs to Dataify using a Dataify API token.

Install this only if you intend to use Dataify to collect YouTube profile data. Be aware that it can use your DATAIFY_API_TOKEN and submit the selected URLs or keywords to Dataify; review the task details before authorizing any run.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill instructs the agent to read a saved environment variable (`DATAIFY_API_TOKEN`) and make outbound network requests to a third-party API, but it does not declare those capabilities as permissions. That creates a transparency and governance gap: users and hosting platforms may not realize the skill can access local secrets and transmit data externally, increasing the risk of unintended token use or data exfiltration if the skill is invoked in the wrong context.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The skill enables implicit invocation and its prompt/description broadly covers choosing modes, submitting tasks, handling tokens, and troubleshooting, which can cause the agent to invoke it for loosely related YouTube or scraping requests. Over-broad triggering is risky because it may initiate external data-collection actions or token-related workflows without sufficiently explicit user intent, increasing the chance of unintended API use or data collection.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.