Withme Youtube

• Analyzed: May 11, 2026, 6:40 AM
• Findings: 1
• Version: 2.1.0
• Hash: 41ae85d6f692adc1bb821a55fd9063f77ece13a8161f0ceba8f2ae43039e8a0b
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle automates a complex YouTube video production pipeline but contains instructions in SKILL.md to intentionally bypass the 'Main' agent's oversight and inspection mechanism (pending.json). It features high-risk behaviors including programmatically extracting API keys from local configuration files (~/.openclaw/openclaw.json) and using Chrome DevTools Protocol (CDP) via websockets to manipulate browser behavior, automate downloads, and circumvent Cloudflare protections. While these actions support the stated automation goals, the circumvention of security gates and direct handling of sensitive credentials represent significant risks.