Wjs Uploading Video

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:45 PM UTC
• Version:
  0.1.0

Overview

This appears to be a legitimate YouTube uploader, but it needs Google OAuth access and stores a reusable token that should be protected.

Install this only if you want an agent-assisted YouTube uploader for your own account. Create the Google OAuth client yourself, keep credentials.json and token.json private with user-only file access, avoid syncing or committing them, run --dry-run for batches, and keep uploads unlisted until you have checked the files and metadata.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill clearly performs sensitive actions—reading local files, writing tokens/results, accessing environment/proxy settings, and making outbound network requests—but does not declare any permissions. That creates a transparency and policy-enforcement gap: an agent or reviewer may invoke the skill without understanding its true access scope, increasing the chance of unintended data access or exfiltration.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document instructs users to store an OAuth client secret in a persistent location but does not tell them to treat it as sensitive credential material. While desktop-app OAuth client files are not as powerful as bearer tokens, they still identify the app and can aid misuse or phishing-style imitation if exposed; the omission increases the chance of insecure storage, accidental sharing, or committing the file to source control.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The file states that `token.json` is written and then reused silently, but does not warn that this token grants ongoing access to the user's YouTube account within the authorized scope. If the token file is copied, leaked, or backed up to an insecure location, an attacker may be able to act on the account without re-prompting the user, making the omission materially dangerous.

VirusTotal

64/64 vendors flagged this skill as clean.