ClawHub
Back to skill

Security audit

TubeScribe

Security checks across malware telemetry and agentic risk

Overview

TubeScribe appears to be a legitimate YouTube summarizer, but it needs review because a YouTube URL can trigger background agent processing with network access, local file writes, and local tool execution without a clear confirmation step.

Install only if you are comfortable with YouTube links starting background processing that fetches public YouTube data, writes local files, invokes local tools, and may send transcript/comment text through your agent model environment. Review setup.py before accepting optional downloads, avoid private or sensitive videos, and consider requiring explicit confirmation before processing each URL.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (23)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Check if a Python package is installed in system Python."""
    import_name = import_name or package
    try:
        result = subprocess.run(
            [sys.executable, "-c", f"import {import_name}"],
            capture_output=True, timeout=10
        )
Confidence
96% confidence
Finding
The script builds Python code dynamically with f"import {import_name}" and executes it via `python -c`. If `import_name` can be influenced through configuration or imported constants, an attacker can inject arbitrary Python statements, turning a dependency check into code execution. In the context of a setup script that users may run locally, this creates a direct local RCE risk.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
# 2. Check shared ML env
    if os.path.exists(ml_env_python):
        try:
            result = subprocess.run(
                [ml_env_python, "-c", "import torch, soundfile, numpy, huggingface_hub"],
                capture_output=True, timeout=10
            )
Confidence
85% confidence
Finding
The script executes a Python interpreter located in a writable user directory (`~/.openclaw/tools/ml-env/bin/python`) to test imports. If an attacker can replace or tamper with that interpreter or environment, running setup will execute attacker-controlled code. Because this is a setup helper likely run interactively, trusting executables from user-writable tool paths increases risk.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
venv_python = os.path.join(kokoro_dir, ".venv", "bin", "python")
    if os.path.exists(venv_python):
        try:
            result = subprocess.run(
                [venv_python, "-c", "from kokoro import KPipeline"],
                capture_output=True, timeout=10, cwd=kokoro_dir
            )
Confidence
88% confidence
Finding
The script runs `~/.openclaw/tools/kokoro/.venv/bin/python` and imports a package from a repo directory under the user's home directory. A tampered virtualenv or malicious `kokoro` package in that location would execute code during what appears to be a harmless dependency check. This makes the setup process a potential code-execution trigger from previously planted files.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
python_path, kokoro_dir = get_python_for_kokoro()
    if python_path and kokoro_dir:
        try:
            result = subprocess.run(
                [python_path, "-c", "from kokoro import KPipeline; print('ok')"],
                capture_output=True, timeout=10, cwd=kokoro_dir
            )
Confidence
88% confidence
Finding
This repeats the same trust issue by executing a discovered Python interpreter and importing `kokoro` from a writable local directory. Any compromise of that interpreter or package contents results in arbitrary code execution during setup validation.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print(local_dir)
'''
    try:
        result = subprocess.run(
            [mlx_python, "-c", code],
            capture_output=True, text=True, timeout=15
        )
Confidence
90% confidence
Finding
This code executes dynamically generated Python via 'python -c' in an interpreter discovered from a user-configurable path. Although some embedded values are JSON-escaped, the larger risk is that the selected interpreter and imported packages come from mutable local locations, so a malicious or trojaned environment can run arbitrary code under the user's privileges.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
print(blend_path)
'''
    try:
        result = subprocess.run(
            [mlx_python, "-c", code],
            capture_output=True, text=True, timeout=30
        )
Confidence
90% confidence
Finding
This is another dynamic 'python -c' execution path against an interpreter chosen from local/configured locations. The generated script imports multiple third-party libraries from that environment and writes files into model cache locations, so a malicious interpreter or package set can achieve arbitrary code execution.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
)
print("OK")
'''
        result = subprocess.run(
            [mlx_python, "-c", code],
            capture_output=True, text=True, timeout=300
        )
Confidence
91% confidence
Finding
This audio-generation path constructs code and executes it with a discovered/configured Python interpreter. Because the interpreter and imported ML packages may live in user-writable directories, compromising that environment leads to arbitrary code execution when TubeScribe generates audio.

subprocess module call

Medium
Category
Dangerous Code Execution
Content
run_kwargs = {"capture_output": True, "text": True, "timeout": 300}
        if os.path.exists(os.path.join(kokoro_dir, "kokoro", "__init__.py")):
            run_kwargs["cwd"] = kokoro_dir
        result = subprocess.run([kokoro_python, "-c", code], **run_kwargs)

        if result.returncode == 0 and os.path.exists(wav_path):
            if audio_format == "mp3":
Confidence
91% confidence
Finding
This executes a substantial dynamically assembled Python program through a potentially user-controlled or locally mutable interpreter. In the skill context, optional TTS tooling is explicitly expected to be installed from local tool directories, which increases the chance that attacker-modified local packages could be executed during normal use.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill directs the agent to use shell commands, read and write files, access configuration in the home directory, and make network requests, yet it declares no permissions. That mismatch weakens user consent and policy enforcement because the runtime may expose materially broader capabilities than the metadata suggests.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The documented purpose says the skill summarizes/transcribes YouTube videos, but the body also includes queue management, comment harvesting, setup/install behavior, and arbitrary text-to-audio generation. This expands the operational scope beyond what a user would reasonably expect, increasing the chance of unintended network access, software changes, or misuse of the audio generation path.

Intent-Code Divergence

Medium
Confidence
88% confidence
Finding
The skill claims the spawned sub-agent has strict instructions not to install software, but later documentation states yt-dlp may be auto-installed. Contradictory safety claims are dangerous because operators may trust the safer statement while the implementation still downloads or installs code.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The workflow explicitly says to stop if a tool is missing, but later documentation says setup will automatically download yt-dlp. This inconsistency can cause an agent or user to believe execution is bounded when the skill may actually fetch external binaries, creating supply-chain and policy-bypass risk.

Vague Triggers

Medium
Confidence
89% confidence
Finding
The activation guidance is very broad: users only need to send a YouTube URL or ask for a summary/transcription, which can easily match ordinary conversation and trigger background processing automatically. In an agent setting, broad auto-activation increases the chance of unintended network access, external tool execution, and content processing from untrusted URLs without sufficiently explicit user intent.

Vague Triggers

Medium
Confidence
84% confidence
Finding
The invocation guidance says to use the skill whenever a user sends a YouTube URL or asks to summarize/transcribe a YouTube video, which is broad enough to trigger on common conversational requests. Over-broad activation is risky here because it can immediately launch background processing with network, file, and shell side effects without a scoped confirmation step.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The workflow instructs the agent to spawn processing immediately for any YouTube URL and not block, but it does not constrain scope or require confirmation. In this skill context that is more dangerous because the spawned pipeline performs network access, document generation, audio creation, cleanup, and folder opening as side effects.

Unvalidated Output Injection

High
Category
Output Handling
Content
"""Check if a Python package is installed in system Python."""
    import_name = import_name or package
    try:
        result = subprocess.run(
            [sys.executable, "-c", f"import {import_name}"],
            capture_output=True, timeout=10
        )
Confidence
97% confidence
Finding
`import_name` is inserted directly into Python code passed to `python -c`, so a crafted value such as `foo; malicious_code` would run arbitrary code. Unlike ordinary subprocess usage, this is an actual code-injection sink inside the Python command string. In a setup script, users may execute it with elevated trust, making exploitation more serious.

Unvalidated Output Injection

High
Category
Output Handling
Content
# 2. Check shared ML env
    if os.path.exists(ml_env_python):
        try:
            result = subprocess.run(
                [ml_env_python, "-c", "import torch, soundfile, numpy, huggingface_hub"],
                capture_output=True, timeout=10
            )
Confidence
86% confidence
Finding
Although the `-c` string here is fixed, the script executes an interpreter from a user-writable path. A malicious replacement interpreter or sitecustomize/startup behavior in that environment could run attacker code during the check, so the security issue is trust in unvalidated executable output paths rather than string injection.

Unvalidated Output Injection

High
Category
Output Handling
Content
venv_python = os.path.join(kokoro_dir, ".venv", "bin", "python")
    if os.path.exists(venv_python):
        try:
            result = subprocess.run(
                [venv_python, "-c", "from kokoro import KPipeline"],
                capture_output=True, timeout=10, cwd=kokoro_dir
            )
Confidence
89% confidence
Finding
This line executes a Python binary from a local virtualenv and imports a package from a writable repo directory. Import-time code execution is normal in Python, so a trojaned package or manipulated environment would run immediately during validation.

Unvalidated Output Injection

High
Category
Output Handling
Content
# Normalize URL to standard format (fixes /live/, /shorts/, etc.)
    normalized_url = normalize_youtube_url(url)
    try:
        result = subprocess.run(
            ["summarize", normalized_url, "--youtube", "auto", "--extract-only", "--timestamps"],
            capture_output=True, text=True, timeout=120  # 2 min timeout for long videos
        )
Confidence
84% confidence
Finding
The transcript returned by the external 'summarize' tool is untrusted remote content and is later written to disk for downstream AI-agent processing with no trust-boundary marking or sanitization. In this skill context, that is meaningfully dangerous because transcripts can contain prompt-injection instructions that target the later agent stage the script explicitly tells the user to run.

Unvalidated Output Injection

High
Category
Output Handling
Content
print(local_dir)
'''
    try:
        result = subprocess.run(
            [mlx_python, "-c", code],
            capture_output=True, text=True, timeout=15
        )
Confidence
91% confidence
Finding
This line executes dynamic Python in a selected interpreter, so any compromised interpreter or malicious package in the chosen environment can run arbitrary code. In a user-facing skill that auto-discovers tools from home-directory locations, this trust boundary is weak and materially increases risk.

Unvalidated Output Injection

High
Category
Output Handling
Content
print(blend_path)
'''
    try:
        result = subprocess.run(
            [mlx_python, "-c", code],
            capture_output=True, text=True, timeout=30
        )
Confidence
91% confidence
Finding
This dynamic execution path performs code generation and runs it inside a potentially mutable local ML environment. A tampered interpreter or dependency tree can execute arbitrary code, and the model-cache file writing expands the blast radius to persistence and file tampering.

Unvalidated Output Injection

High
Category
Output Handling
Content
)
print("OK")
'''
        result = subprocess.run(
            [mlx_python, "-c", code],
            capture_output=True, text=True, timeout=300
        )
Confidence
92% confidence
Finding
The application generates and runs Python code to perform TTS in an auto-discovered environment. Because this skill encourages optional local tool installation, a malicious local package or interpreter can hijack execution during ordinary audio generation.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
| Option | Default | Description |
|--------|---------|-------------|
| `processing.subagent_timeout` | `600` | Seconds for sub-agent (increase for long videos) |
| `processing.cleanup_temp_files` | `true` | Remove /tmp files after completion |

### Comment Options
| Option | Default | Description |
Confidence
72% confidence
Finding
The skill advertises cleanup of temporary files with a broad 'Remove /tmp files after completion' description, but does not define which paths are safe to delete. Ambiguous cleanup behavior in a shell-capable skill can lead to accidental deletion of unrelated temporary data or abuse if path handling is influenced by external input.

VirusTotal

56/56 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.