Youtube video scorer

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it claims—call WorthClip’s API to score YouTube videos and retrieve feed or usage data—but it requires trusting WorthClip’s backend with a WorthClip API key.

Before installing, verify that you trust WorthClip and the disclosed Convex API backend, use a revocable API key, and only approve actions that change your WorthClip account when you explicitly want them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone installing the skill must trust the WorthClip API endpoint with the WorthClip API key they provide.

Why it was flagged

The script requires a WorthClip API key and sends it as an Authorization bearer token to the service API. This is expected for the stated integration, but it is still credential use.

Skill content

API_KEY="${WORTHCLIP_API_KEY:?Set WORTHCLIP_API_KEY}" ... -H "Authorization: Bearer $API_KEY"

Recommendation

Use a WorthClip API key intended for this integration, keep it private, and revoke or rotate it if no longer needed.

Note

ASI02: Tool Misuse and Exploitation

What this means

If used, the agent could make changes inside the WorthClip account, such as tracking a channel or updating learning preferences.

Why it was flagged

The API reference documents write endpoints that can change WorthClip account state. These operations fit the skill’s stated purpose but should remain user-directed.

Skill content

| /channels/track | POST | Track a new channel | ... | /persona | PUT | Update persona description | ... | /goals | PUT | Update learning goals |

Recommendation

Confirm account-changing actions before allowing the agent to call write endpoints, especially persona, goals, or channel-tracking changes.