Youtube Factory

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:48 AM UTC
• Version: 1.3.0

Overview

This skill appears to generate videos as advertised, with expected external tools and services, but its documentation overstates being self-contained.

Install only if you are comfortable installing the listed media tools and Python packages, using a Pexels API key, creating potentially large media files under ~/Videos/OpenClaw/, and sending video topics/search phrases/narration to Pexels and Microsoft Edge TTS. Avoid confidential, regulated, or proprietary prompts unless those third-party data flows are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

with open(ass_file, "w") as f:
        f.write(content)
    subprocess.run([
        "ffmpeg", "-y", "-i", video_path, "-vf", f"ass={ass_file}",
        "-c:v", "libx264", "-c:a", "copy", output_path
    ], capture_output=True)

• Confidence: 84% confidence
• Finding: subprocess.run([ "ffmpeg", "-y", "-i", video_path, "-vf", f"ass={ass_file}", "-c:v", "libx264", "-c:a", "copy", output_path ], capture_output=True)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill appears to use environment variables, filesystem writes, network access, and shell-executed tooling, yet the static finding says no permissions are declared for those capabilities. That is dangerous because users may invoke the skill without understanding that it will access external services and create files locally, reducing informed consent and weakening sandbox/policy enforcement.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The description claims the skill is self-contained and uses no external modules, but the documentation shows dependency on Pexels, Edge TTS, FFmpeg/ffprobe, and Python packages. This mismatch is risky because it can mislead users and reviewers about external data flows, dependency trust, and the true attack surface, especially where prompts or generated content are sent to third parties.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The manifest advertises 'self-contained, no external modules' while the setup instructions require multiple external binaries and Python packages. This is a trust and transparency problem that can cause users to install or run extra software under false assumptions, increasing exposure to dependency compromise or unsafe execution environments.

Description-Behavior Mismatch

Medium

• Confidence: 78% confidence
• Finding: The skill advertises itself as self-contained and requiring no external modules, but it depends on requests, Pillow, edge-tts, ffmpeg/ffprobe, and external network services. This discrepancy can mislead operators into granting it more trust or running it in environments where network and tool access were not expected.

Intent-Code Divergence

Medium

• Confidence: 78% confidence
• Finding: The inline docs explicitly claim self-contained behavior despite multiple external dependencies and service calls. Misrepresentation is security-relevant because reviewers and users may underestimate data egress and execution surface.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The skill writes several generated media files into the user's home directory, but the description does not prominently warn about this behavior. While expected for a video-generation tool, undisclosed persistent writes can surprise users, consume significant disk space, and expose sensitive generated content to other local processes or users.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill description does not clearly warn that prompts/content may be sent to external services such as Pexels and Edge TTS. This matters because user-provided topics or scripts may contain sensitive or proprietary information, and sending them to third parties without explicit notice creates privacy and compliance risk.

Unvalidated Output Injection

High

• Category: Output Handling

Content

with open(ass_file, "w") as f:
        f.write(content)
    subprocess.run([
        "ffmpeg", "-y", "-i", video_path, "-vf", f"ass={ass_file}",
        "-c:v", "libx264", "-c:a", "copy", output_path
    ], capture_output=True)

• Confidence: 85% confidence
• Finding: subprocess.run([ "ffmpeg", "-y", "-i", video_path, "-vf", f"ass={ass_file}", "-c:v", "libx264", "-c:a", "copy", output_path ], capture_output

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.