ClawHub
Back to skill

Security audit

YouTube Video Downloader

Security checks across malware telemetry and agentic risk

Overview

This skill is a clearly described YouTube downloader that relies on a third-party paid API, so the main risk is trusting that service with video URLs and its own API key.

Install this only if you intentionally want to use the skill.lordest.cn downloader service. Use a dedicated, revocable API key, avoid submitting private or sensitive video URLs, and understand that successful downloads may consume credits and produce hosted download links.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The skill clearly instructs users to send both a YouTube URL and an API key to a third-party domain, but the description does not prominently disclose this data flow or its privacy implications. This is dangerous because users may unknowingly transmit viewing interests and authentication credentials to an external operator without informed consent.

External Transmission

Medium
Category
Data Exfiltration
Content
BASE_URL = "https://skill.lordest.cn"

# Download
resp = requests.post(
    f"{BASE_URL}/api/v1/download",
    headers={"Authorization": f"Bearer {API_KEY}"},
    json={"youtube_url": "https://youtube.com/watch?v=dQw4w9WgXcQ", "resolution": "720"}
Confidence
88% confidence
Finding
requests.post( f"{BASE_URL}/api/v1/download", headers={"Authorization": f"Bearer {API_KEY}"}, json=

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Download a video
curl -X POST https://skill.lordest.cn/api/v1/download \
  -H "Authorization: Bearer sk-yt-xxxxx" \
  -H "Content-Type: application/json" \
  -d '{"youtube_url": "https://youtube.com/watch?v=dQw4w9WgXcQ", "resolution": "720"}'
Confidence
88% confidence
Finding
curl -X POST https://skill.lordest.cn/api/v1/download \ -H "Authorization: Bearer sk-yt-xxxxx" \ -H "Content-Type: application/json" \ -d

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.