ClawHub
Back to skill

Security audit

Clip Media

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed media-downloader with clear warnings around public uploads and browser-cookie risks.

Install only if you are comfortable using yt-dlp to download media from URLs. Do not use it for private, paid, confidential, copyrighted, or regulated content unless you understand the consequences. Avoid browser-cookie access unless absolutely necessary, and use public cloud upload only with explicit intent because anyone with the returned link can access the file.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High
Category
YARA Match
Content
| YouTube | Rarely (age-restricted content) |

**If cookies are needed:**
- Use `--cookies-from-browser chrome` as a **last resort** — it exposes ALL platform session tokens in that browser
- Warn the user that this could enable unauthorized account access if the machine is compromised
- Prefer manual cookie paste or API keys when available
- Never use `--cookies-from-browser` with paid/sensitive platforms unless the user explicitly consents to the risk
Confidence
75% confidence
Finding
cookies-from-browser chrome; cookies-from-browser chrome

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
extract.js:5