ClawHub
Back to skill

Security audit

Youtube Content

Security checks for vulnerabilities and agentic risk

Overview

The skill is a YouTube transcript and metadata CLI with expected network access, plus a bundled CI verifier that is risky only if deliberately run on untrusted folders.

Install only if you are comfortable with a local Python script making requests to YouTube and Invidious. Use the YouTube CLI normally; avoid running the bundled CI verifier on untrusted folders unless isolated from secrets and sensitive files.

SkillSpector

Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def has_self_test(fp):
    r = subprocess.run([sys.executable, fp, "self-test"], capture_output=True, text=True, timeout=30)
    return r.returncode == 0 and "PASS" in r.stdout
Confidence
97% confidence
Finding
This helper executes an arbitrary Python file from the target product folder to check for a `self-test` mode. In a CI or verification context, that means untrusted repository code is run during validation, enabling arbitrary code execution with the permissions of the verifier. The risk is heightened because the script is explicitly intended to process skill/product folders that may be adversarial.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
tests = [os.path.join(folder, f) for f in os.listdir(folder)
                 if (f.startswith("test_") or f.endswith("_test.py")) and f.endswith(".py")]
        if tests:
            st_ok = all(subprocess.run([sys.executable, t], capture_output=True, text=True,
                                      timeout=30).returncode == 0 for t in tests)
            st_note = f"{len(tests)} test_*.py"
        elif re.search(r"(?im)^test\s*:", skill_txt):
Confidence
97% confidence
Finding
This executes any `test_*.py` or `*_test.py` file found in the target folder. Since those files are repository-controlled, an attacker can place arbitrary Python code in a test file and gain code execution when CI verification runs. In the context of a skill ingestion/validation pipeline, this is a genuine unsafe execution path.

Lp3

Medium
Category
MCP Least Privilege
Confidence
72% confidence
Finding
The skill advertises itself as a simple YouTube transcript/summary tool, but the package is reported to require file read, network, and shell-like capabilities without declaring permissions. Undeclared capabilities reduce transparency and can cause an agent or user to invoke a tool with more authority than expected, increasing the chance of unintended data access or command execution paths.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding
The reported behavior substantially exceeds the stated purpose: in addition to YouTube content extraction, the skill appears to perform repository validation, Python compilation, subprocess-based test execution, secret scanning, and external API search. This mismatch is dangerous because users or agent frameworks may grant trust based on the benign description while the skill executes broader local-analysis and command-execution functionality that can touch files, run code, and exfiltrate data over the network.

Static analysis

No suspicious patterns detected.