ClawHub
Back to skill

Security audit

YouTube Channel Compare

Security checks for vulnerabilities and agentic risk

Overview

The skill appears focused on comparing YouTube channels, but its install instructions pull changeable remote code directly into the active skills folder without integrity checks.

Review or pin the exact GitHub revision before installing, and prefer installing the packaged reviewed files instead of downloading from main. The audited script itself looks task-focused, but only run it with normal user privileges and expect it to contact YouTube through yt-dlp and write reports locally.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning
Location
SKILL.md:19
Finding

Mutable Remote Skill and Python Payload Installed Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:19-20, 27-29, 36, 42
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: Medium

The installation instructions retrieve Skill instructions and executable Python source from a mutable branch of a personal GitHub repository. Neither the downloaded files nor the cloned repository are pinned to a reviewed commit, authenticated release, checksum, or cryptographic signature.

Vulnerable Code

PowerShell installation (SKILL.md:19-20):

powershell
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-channel-compare/SKILL.md" -OutFile "$skillDir\SKILL.md"
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-channel-compare/scripts/compare_channels.py" -OutFile "$skillDir\scripts\compare_channels.py"

macOS/Linux installation (SKILL.md:27-29):

bash
curl -o ~/.agents/skills/youtube-channel-compare/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-channel-compare/SKILL.md
curl -o ~/.agents/skills/youtube-channel-compare/scripts/compare_channels.py \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-channel-compare/scripts/compare_channels.py

Repository cloning alternatives (SKILL.md:36, 42):

powershell
git clone https://github.com/mcbaivn/openclaw-skills-mcbai.git
bash
git clone https://github.com/mcbaivn/openclaw-skills-mcbai.git

Technical Analysis

The raw-file URLs reference the mutable main branch. Consequently, the content installed by these commands can differ from the content that was statically audited. The clone alternatives likewise retrieve the current repository state without checking out a fixed, reviewed commit.

The downloaded `compare_ch ...[truncated 2382 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove remote replacement downloads when the Skill is distributed as a complete artifact. Install the reviewed local files instead.
  2. If remote installation is necessary, reference an immutable reviewed commit rather than the mutable main branch.
  3. Publish trusted SHA-256 checksums through a separately authenticated channel and verify each file before moving it into ~/.agents/skills.
  4. Prefer signed releases or signed Git tags, and verify the signature and expected signer during installation.
  5. For Git-based installation, check out an explicit commit hash and verify that it matches the documented reviewed revision.
  6. Download into a staging directory first. Activate the Skill only after all integrity and authenticity checks succeed.
  7. Use failure-aware download options such as curl --fail --location --show-error so HTTP errors are not silently saved as Skill files.
  8. Document and pin the required yt-dlp dependency through a controlled dependency-management process.
  9. Run the comparison script with ordinary user privileges and restrict access to unnecessary secrets or sensitive directories.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill documents shell execution and filesystem modification behavior but does not declare any explicit tool scope such as allowed tools or permissions. That creates an authorization/expectation gap where an agent or user may invoke code-capable behavior without clear constraints, increasing the chance of unintended command execution or local file changes.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The instructions create a persistent directory under ~/.agents/skills and place downloaded files there, making the code available across future sessions. Persistence increases risk because a remotely fetched script can remain installed and later be executed by an agent or user long after the original install step.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash
# macOS / Linux
mkdir -p ~/.agents/skills/youtube-channel-compare/scripts
curl -o ~/.agents/skills/youtube-channel-compare/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-channel-compare/SKILL.md
curl -o ~/.agents/skills/youtube-channel-compare/scripts/compare_channels.py \

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

bash
# macOS / Linux
mkdir -p ~/.agents/skills/youtube-channel-compare/scripts
curl -o ~/.agents/skills/youtube-channel-compare/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-channel-compare/SKILL.md
curl -o ~/.agents/skills/youtube-channel-compare/scripts/compare_channels.py \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-channel-compare/scripts/compare_channels.py

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/compare_channels.py (reported line 28)May include surrounding context.

python
"--print", '{"title":"%(title)s","url":"%(url)s","view_count":%(view_count)s,"like_count":%(like_count)s,"comment_count":%(comment_count)s,"upload_date":"%(upload_date)s","channel":"%(channel)s"}',
        url
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    videos = []
    for line in result.stdout.strip().split('\n'):
        if not line.strip():

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

These instructions download remote content from GitHub and write it directly into the local agent skill directory without any warning or integrity verification. Even if common for installation docs, this is risky because a user may import and later execute unreviewed code from a remote source with little visibility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The clone/copy workflow persists a full repository or skill files into the user's local skill path without warning about filesystem changes or the trust implications of importing code. This can expose users to supply-chain risk if the repository contents change or contain additional unexpected files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The file contains user-facing descriptions and runtime messages in Vietnamese, starting in the module docstring and continuing throughout the CLI output. Because the script does not offer any language selection or indicate that it is intentionally limited to Vietnamese users, it violates the language/locale policy requirement for user opt-in or clear justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.