ClawHub
Back to skill

Security audit

Withme Youtube

Security checks for vulnerabilities and agentic risk

Overview

The skill is a disclosed YouTube production workflow, but it grants broad credential, browser-session, download, and publishing authority without enough containment or final user control.

Install only if this is a trusted personal workflow and you can verify the shared scripts, credentials, browser profile, and upload queue. Use restricted Google and YouTube credentials, an isolated browser profile for Envato, staging for downloads, and a final explicit approval showing the resolved channel, file hashes, title, thumbnail, visibility, and schedule before upload.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:68
Finding

Sensitive API Key Exposed to an Unaudited External Script

Content
View full analysis
" \ --filename "~/Projects/withme-youtube/images/originals/v{N}/scene_{i}.png" \ --resolution 2K ``` ### Technical Analysis The workflow reads a Google API key directly from the global OpenClaw configuration and places it in the environment of `/Users/withme/.openclaw/shared/generate_image.py`. That script is outside the audited project and was therefore not available for integrity or behavior verification. Although transmitting an API credential to the relevant image-generation provider is necessary for the declared functionality, directly granting an external script the raw credential is broader than necessary. The script can read, log, persist, or transmit the environment variable to any destination. The use of `uv run` may also involve dependency resolution whose security properties are not specified by this project. The issue is not evidence that the included Skill intentionally steals the key. It is a confirmed insecure trust boundary: sensitive information is extracted from a global credential store and delivered to code whose contents and integrity are not controlled by the audited package. ### Attack Path 1. An attacker gains the ability to replace or modify `/Users/withme/.openclaw/shared/generate_image.py`, or compromises code imported by that script. 2. A user invokes the image-generation stage of the Skill. 3. The embedded Python expression reads the Google API key from `$HOME/.openclaw/openclaw.json`. 4. The shell exports the key as `GEMINI_API_KEY` to the external process. 5. The compromised proces ...[truncated 772 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
SKILL.md:85
Finding

Overprivileged Control of an Authenticated Browser Through CDP

Content
View full analysis
"}})) await ws.recv() # Step 2: Use JavaScript to click Download buttons await ws.send(json.dumps({"id":3,"method":"Runtime.evaluate", "params":{"expression":"document.querySelectorAll('button').forEach(b=>{if(b.textContent.trim()==='Download')b.click()})"}})) # Step 3: Wait for completion by monitoring downloaded files ``` ### Technical Analysis The Skill connects to the browser's Chrome DevTools Protocol endpoint and obtains a WebSocket debugger URL for a page whose URL merely contains the substring `envato`. It then invokes `Runtime.evaluate`, which provides arbitrary JavaScript execution within the authenticated page. This authority is substantially broader than the minimum permission needed to download one selected licensed asset. CDP can inspect page content, interact with authenticated controls, execute arbitrary JavaScript, initiate downloads, and potentially access any browser target exposed by the debugging service. Target validation is also weak. A substring check does not validate the URL scheme, exact hostname, port, browser profile, or expected page state. The JavaScript clicks every button whose trimmed text is exactly `Download`, ...[truncated 1992 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:153
Finding

External YouTube Uploader Granted OAuth Credentials and Publishing Authority

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The description promises a full production pipeline with broad automation from topic selection through publishing. However, the provided code chunk is merely a scaffold/template script containing variable definitions such as duration, scene count, audio file names, and encoding settings, followed by echo statements warning that the script must be copied and edited before use. There are no commands invoking FFmpeg, no network access or download logic, no AI image generation, no SEO output creation, and no YouTube API/upload functionality. This is a material description-behavior mismatch because the actual code does not implement the core declared capabilities.

Content

No source excerpt is available for this finding.

Vague Triggers

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The trigger list includes broad natural-language phrases such as 'withme', 'YouTube发布', and '开始制作', which can accidentally activate a workflow that performs downloading, file writes, and account actions. Because the skill is highly automated, unintended activation materially increases the risk of unauthorized operations.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow schedules YouTube uploads using stored OAuth credentials and an automated queue, yet does not place a strong user-facing warning or approval gate around the account action. This can lead to unauthorized publication, reputational damage, channel policy violations, or abuse of a logged-in account if the skill is triggered accidentally or altered.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
98% confidence
Finding

The skill references a local OAuth client secret file used for YouTube uploads. Embedding reliance on a static secret file in an automated skill increases the chance of credential exposure, unauthorized API use, and account compromise, especially when combined with automatic upload/scheduling behavior.

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

}

text
2. 上传脚本：`~/.openclaw/shared/youtube_upload.py`
3. OAuth 凭证：`~/.openclaw/shared/youtube_client_secret.json`
4. Google 账号：`kylin1986@gmail.com`

### 阶段 8：Shorts 切片 ⏱️ ~10 分钟（上传后自动）

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill instructs direct extraction of an API key from a local configuration file and later relies on stored OAuth secrets for account actions. Accessing secrets from disk inside an automated workflow expands the skill's privileges beyond simple media production and creates a path for unauthorized use of cloud APIs or account takeover if the workflow is misused or modified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill automatically reads a stored API key without presenting a clear warning or consent boundary to the operator. Silent credential consumption is dangerous because users may not realize the workflow can spend quota, access paid services, or expose sensitive configuration through logs or downstream tools.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill performs automated downloads and ZIP extraction into local project directories with no visible warning or approval checkpoint. Unreviewed downloads can overwrite files, consume storage, introduce malicious content into the workspace, or chain into later processing steps such as FFmpeg and upload automation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow uses Chrome DevTools Protocol to discover browser targets, alter download behavior, and execute page-side JavaScript clicks. That browser-control capability is powerful and can be repurposed to manipulate authenticated sessions, trigger unintended actions, or bypass normal user review on third-party sites.

Content

No source excerpt is available for this finding.

Internal Network Request

Medium
Category
Server-Side Request Forgery
Confidence
87% confidence
Finding

The skill makes a request to a localhost CDP endpoint and then uses discovered WebSocket debugger targets to control the browser. Even though the destination is local, this is still sensitive because it reaches an internal service that may expose powerful browser debugging capabilities not intended for arbitrary workflows.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

python
# Step 1: 用 CDP 设定下载路径（每个 page target 需单独设定）
import asyncio, json, websockets, urllib.request
targets = json.loads(urllib.request.urlopen("http://127.0.0.1:18800/json").read())
page_ws = [t["webSocketDebuggerUrl"] for t in targets if "envato" in t.get("url","")][0]
async with websockets.connect(page_ws) as ws:
    await ws.send(json.dumps({"id":1,"method":"Network.enable"}))

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The publishing settings specify “语言：English” as a fixed requirement, while the rest of the workflow includes Chinese-language materials and no user opt-in for this locale choice. This is a natural-language policy concern because it imposes a language setting without presenting alternatives or documenting why English is mandatory.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file uses Chinese throughout headings, labels, and status text, but does not indicate that the skill is region-specific or provide any user opt-in for language/locale. Under the policy rule, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.