Youtube Video Ideas

• Outcome: Review
• Latest audit: Sep 11, 2026 · 5:05 AM UTC
• Version: 1.1.2

Overview

The skill mainly matches its YouTube-idea purpose, but it automatically performs paid billing with an embedded merchant key and has supply-chain weaknesses that users should review first.

Review this skill before installing. It is paid by default, contacts SkillPay, contains a public fallback merchant key, and runs a local OpenClaw agent with your supplied topic text. Only use it if you understand the billing flow, can run it in test mode when needed, and accept the dependency and installer risks.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:8

Finding

Hard-Coded SkillPay Merchant Credential

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: index.js:14

Finding

Agent Prompt Injection Through Unsanitized Topic and Niche Values

Content

View full analysis

{ const child = spawn('openclaw', ['agent', '--agent', 'sloan', '-m', prompt], { ``` The values originate from command-line arguments: ```javascript const topic = args[0]; const options = { niche: args.includes('--niche') ? args[args.indexOf('--niche') + 1] : null, outline: args.includes('--outline'), testMode: args.includes('--test') }; ``` ### Technical Analysis The command-line `topic` and `niche` values are interpolated directly into the instruction prompt sent to the Sloan agent. Quotation marks and a `Niche:` prefix do not create a trusted instruction boundary for a language model. A crafted value can contain imperative language that asks the agent to disregard the intended video-generation task. This is not operating-system command injection: `spawn` receives an argument array and does not invoke a shell. ...[truncated 1321 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:12

Finding

Installation Instructions Execute a Mutable Third-Party Latest Release

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: package-lock.json:16

Finding

Locked Dependencies Use an Unofficial Plaintext HTTP Registry Mirror

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose is simple content generation, but the metadata indicates additional behaviors involving payment processing, a default embedded merchant credential, and invocation of an external/local agent path. This mismatch is dangerous because users may authorize or install the skill expecting harmless idea generation while it can trigger billing or interact with other services outside the stated scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

A hardcoded fallback merchant key is a credential exposure issue and can enable unauthorized billing activity if the code is shared, published, or reused. Embedding payment secrets in source code is especially dangerous because anyone with repository or package access can extract and abuse the key against the merchant account.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The lockfile pins axios 1.13.6, and the finding reports multiple published advisories including SSRF and prototype-pollution-related request manipulation issues. In an agent skill, HTTP client behavior is security-sensitive because model- or user-influenced URLs, proxy settings, redirects, and headers can turn dependency flaws into credential leakage, SSRF, or traffic hijacking.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names and filenames. If this skill or future updates construct multipart requests using untrusted input, an attacker may be able to smuggle crafted headers or alter request structure, potentially leading to request corruption or downstream security issues.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The skill depends on axios through a vulnerable version range, and the cited advisories include SSRF and man-in-the-middle/prototype-pollution-related risks. In an agent skill context that may make outbound requests or process remote content, a vulnerable HTTP client can materially increase the chance of request tampering, credential leakage, or network boundary bypass if the affected code paths are used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The README instructs users to run npx clawhub@latest install youtube-video-ideas, which pulls and executes the latest published package version at install time rather than a pinned, reviewed version. This creates a supply-chain risk: if the package is compromised or a malicious version is published, users may execute attacker-controlled code simply by following the documentation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README states that usage is pay-per-use and that payment is handled automatically with an embedded merchant key, but it does not clearly warn users when charges will occur, what triggers billing, or how consent is obtained. In a CLI/agent skill context, this is risky because users may invoke commands expecting local generation and unintentionally authorize paid remote actions or incur repeated charges.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill advertises access to environment variables but does not declare any explicit tool scope or permissions boundary. That makes credential access implicit rather than user-visible, increasing the chance that sensitive variables such as payment or gateway tokens are read without informed consent or proper sandboxing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The environment variable documentation explicitly mentions an embedded payment key used by default and a gateway authentication token, but gives no warning that the skill may perform authenticated network or billing actions. Embedded or default credentials are especially risky because they can enable unauthorized charging, misuse of shared merchant accounts, or silent authenticated calls without the operator understanding the trust implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.js (reported line 7)May include surrounding context.

js

const { spawn } = require('child_process');

const CONFIG = {
  skillpay_api: 'https://api.skillpay.me/v1',
  merchant_key: process.env.SKILLPAY_MERCHANT_KEY || 'sk_91fff75ae2a7a71f8eceadcbcd816e24d57e58d9d04ccca45f0b3856af130aea',
  price_per_use: 0.002,
  currency: 'USDT'

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

To generate ideas, the code spawns the external 'openclaw' executable as a child process rather than using a clearly scoped in-process implementation. Launching subprocesses is a broader execution capability than what is naturally implied by a skill whose stated purpose is generating YouTube ideas.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The skill forwards user-supplied topic content to an external subprocess agent without clearly informing the user how that content is handled. This is risky because prompts may contain sensitive business or personal information, and the downstream agent may transmit, log, or retain that data outside the user's expectations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill performs a real billing charge even though its stated purpose is only generating YouTube video ideas. Hidden or weakly disclosed payment behavior is dangerous because users may trigger financial transactions unexpectedly, and the code automatically submits billing data to a third-party API before completing the core task.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The code transmits billing data and attempts to charge the user without a strong upfront confirmation step beyond CLI help text. In the context of a simple idea-generation skill, silent payment submission increases the risk of deceptive billing, accidental charges, and privacy concerns around sharing transaction metadata with a third party.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this package, any authenticated outbound request that follows redirects could disclose API keys, bearer tokens, or internal credentials to an attacker-controlled host.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manifest description says only that this is an 'AI-powered YouTube video ideas generator with Sloan agent,' but it does not specify when the skill should activate, what user intents should invoke it, or any constraints or exclusions. In a manifest file, this kind of broad description can create ambiguous matching against general requests about YouTube or video content.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 87% confidence

Finding

Using a caret range for axios allows future installs to resolve to newer versions within the major range, which can introduce unreviewed behavior changes or newly disclosed security issues. This is primarily a supply-chain hardening weakness rather than an immediately exploitable bug in the file alone.

Content

Scanner excerpt · package.json (reported line 20)May include surrounding context.

json

"author": "Matt",
  "license": "MIT",
  "dependencies": {
    "axios": "^1.6.0"
  },
  "openclaw": {
    "skill": true,

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:40

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:8