ClawHub
Back to skill

Security audit

Youtube

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it asks users to run mutable third-party installs with an API key and overstates how contained that access is.

Review this skill before installing. Prefer pinned, reviewed dependency versions or an isolated container, avoid global installs where possible, provide only the YouTube API key in the process environment, restrict the key to YouTube Data API v3 with quotas, and treat generated transcript files as local data that may need deletion.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:24
Finding

Unpinned Third-Party Dependencies Permit Remote Supply-Chain Code Execution

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:24-31, SKILL.md:69-75, and SKILL.md:220-225
Vulnerability Type: Unpinned and unverified third-party dependency execution
Risk Level: High

Vulnerable Code

SKILL.md:24-31:

bash
npm install -g zubeid-youtube-mcp-server

Fallback tool (if MCP fails):

bash
# yt-dlp for transcript extraction
pip install yt-dlp

SKILL.md:69-75:

bash
cd /tmp
git clone https://github.com/ZubeidHendricks/youtube-mcp-server
cd youtube-mcp-server
npm install
npm run build

SKILL.md:220-225:

bash
cd /tmp
git clone https://github.com/ZubeidHendricks/youtube-mcp-server
cd youtube-mcp-server
npm install
npm run build

Technical Analysis

The Skill instructs users or agents to install globally executable npm and Python packages without pinning exact versions. It also offers a fallback that clones the current state of a remote GitHub repository, installs its transitive dependencies, and runs its build scripts.

No package version, Git commit, lockfile, checksum, signature, or other integrity control is specified. Consequently, the code executed during installation or use can change after this Skill has been reviewed. Package lifecycle scripts, build scripts, the MCP server, or transitive dependencies can execute code with the privileges of the invoking user.

This is especially sensitive because the MCP server is expected to receive YOUTUBE_API_KEY. The claim in SKILL.md that the server only contacts googleapis.com and has been reviewed cannot be independently verified from this project: the dependency source is not included, and the instructions do not identify the exact reviewed revision.

The network access and use of a YouTube API key are necessary for the declared YouTube research functionality. However, passing that credential to mutable, remotely sourced code creates a trust boundary broader than the ...[truncated 1850 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the npm and Python dependencies to exact, reviewed versions rather than installing the latest available release.
  2. Pin the source-build fallback to a specific reviewed Git commit instead of cloning and executing the repository's mutable default branch.
  3. Provide and enforce package lockfiles with integrity metadata for all transitive dependencies.
  4. Publish expected cryptographic checksums or signatures and verify downloaded artifacts before installation or execution.
  5. Document the precise package versions and Git revision for which the security claims were validated.
  6. Avoid global npm installation. Install dependencies in an isolated project directory, container, or restricted runtime.
  7. Disable package lifecycle scripts during installation where feasible, and explicitly review any build or lifecycle scripts that must run.
  8. Run the MCP server with a minimal environment containing only the required YouTube API key. Do not expose unrelated credentials.
  9. Restrict the API key to YouTube Data API v3, apply appropriate quotas, monitor its use, and rotate it if unexpected activity occurs.
  10. Restrict filesystem and outbound network access so the server can reach only the endpoints required for the declared functionality.
  11. Replace the unverifiable statement that no third-party servers are involved with a qualified statement tied to a specific audited revision and documented network allowlist.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 22)May include surrounding context.

md
## Configuration

Get a YouTube API key from [Google Cloud Console](https://console.cloud.google.com):
1. Create a project
2. Enable YouTube Data API v3
3. Create credentials → API Key

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The README explicitly recommends placing a YouTube API key in a plaintext local config file and does not warn that the credential is sensitive or should be protected. While this is common in developer docs, it increases the chance of accidental disclosure through dotfile backups, screenshots, shell history, repo commits, or permissive filesystem access, which could allow unauthorized use of the API key and quota exhaustion.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
- Menu → "APIs & Services" → "Library"
   - Search: "YouTube Data API v3"
   - Click "Enable"
4. Create credentials:
   - "APIs & Services" → "Credentials"
   - "Create Credentials" → "API Key"
   - Copy the key

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documented yt-dlp commands hard-code --sub-lang en, which imposes an English-only locale choice in the skill instructions. Because the file does not present this as optional or justified as a region-specific constraint, it violates the language/locale policy for natural-language behavior.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The security note makes a materially misleading trust claim by stating that all network calls go only to googleapis.com and that no third-party servers are involved, while the same skill explicitly instructs users to install packages from npm, clone code from GitHub, and use yt-dlp against youtube.com. This can cause users to underestimate supply-chain and network exposure and to handle the API key less cautiously than warranted.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill documentation tells the user to run yt-dlp with an output path under /tmp and then read the generated .vtt file, which creates local files containing transcript data. While the command is functional, the markdown does not explicitly warn that transcript contents will be written to disk, which may matter for privacy or data-handling expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.