summarizer

• Analyzed: Apr 20, 2026, 8:16 AM
• Findings: 1
• Version: 1.0.0
• Hash: 6642333fd849ad81bafc5e27cdad33f2d3b5212f6187ed1e57f49e958fe1741d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill exhibits high-risk behavior by executing shell commands with inline Node.js scripts and installing external dependencies directly from GitHub (SKILL.md, package.json). The transcript fetching logic is vulnerable to command and JavaScript injection if the video ID extraction is not strictly validated by the agent. While the functionality aligns with the stated purpose of YouTube summarization and uses a specific API (api.heybossai.com), the requirement for root-level directory access (/root/clawd) and the potential for arbitrary code execution through unsanitized inputs represent a significant security risk.