ClawHub
Back to skill

Security audit

Youtube Factory

Security checks across malware telemetry and agentic risk

Overview

This skill appears to generate videos as advertised, with expected external tools and services, but its documentation overstates being self-contained.

Install only if you are comfortable installing the listed media tools and Python packages, using a Pexels API key, creating potentially large media files under ~/Videos/OpenClaw/, and sending video topics/search phrases/narration to Pexels and Microsoft Edge TTS. Avoid confidential, regulated, or proprietary prompts unless those third-party data flows are acceptable.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
with open(ass_file, "w") as f:
        f.write(content)
    subprocess.run([
        "ffmpeg", "-y", "-i", video_path, "-vf", f"ass={ass_file}",
        "-c:v", "libx264", "-c:a", "copy", output_path
    ], capture_output=True)
Confidence
84% confidence
Finding
The ffmpeg ass filter is fed a temp-file path directly inside a filter expression string. If the temp path or related path handling contains ffmpeg-special characters such as ':' or quotes on some platforms, filter parsing can break or reference unintended locations, creating injection-like behavior within ffmpeg's own parser.

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill appears to use environment variables, filesystem writes, network access, and shell-executed tooling, yet the static finding says no permissions are declared for those capabilities. That is dangerous because users may invoke the skill without understanding that it will access external services and create files locally, reducing informed consent and weakening sandbox/policy enforcement.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The description claims the skill is self-contained and uses no external modules, but the documentation shows dependency on Pexels, Edge TTS, FFmpeg/ffprobe, and Python packages. This mismatch is risky because it can mislead users and reviewers about external data flows, dependency trust, and the true attack surface, especially where prompts or generated content are sent to third parties.

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The manifest advertises 'self-contained, no external modules' while the setup instructions require multiple external binaries and Python packages. This is a trust and transparency problem that can cause users to install or run extra software under false assumptions, increasing exposure to dependency compromise or unsafe execution environments.

Description-Behavior Mismatch

Medium
Confidence
78% confidence
Finding
The skill advertises itself as self-contained and requiring no external modules, but it depends on requests, Pillow, edge-tts, ffmpeg/ffprobe, and external network services. This discrepancy can mislead operators into granting it more trust or running it in environments where network and tool access were not expected.

Intent-Code Divergence

Medium
Confidence
78% confidence
Finding
The inline docs explicitly claim self-contained behavior despite multiple external dependencies and service calls. Misrepresentation is security-relevant because reviewers and users may underestimate data egress and execution surface.

Missing User Warnings

Low
Confidence
77% confidence
Finding
The skill writes several generated media files into the user's home directory, but the description does not prominently warn about this behavior. While expected for a video-generation tool, undisclosed persistent writes can surprise users, consume significant disk space, and expose sensitive generated content to other local processes or users.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill description does not clearly warn that prompts/content may be sent to external services such as Pexels and Edge TTS. This matters because user-provided topics or scripts may contain sensitive or proprietary information, and sending them to third parties without explicit notice creates privacy and compliance risk.

Unvalidated Output Injection

High
Category
Output Handling
Content
with open(ass_file, "w") as f:
        f.write(content)
    subprocess.run([
        "ffmpeg", "-y", "-i", video_path, "-vf", f"ass={ass_file}",
        "-c:v", "libx264", "-c:a", "copy", output_path
    ], capture_output=True)
Confidence
85% confidence
Finding
The ass filter argument embeds a file path directly into ffmpeg filter syntax, which has its own escaping rules separate from shell escaping. Unsafe characters in the path can alter parsing, fail open/closed unpredictably, or point ffmpeg at unintended resources, making this more dangerous than the other subprocess findings.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.