Security audit

YouTube Content Analyzer

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly matches its YouTube subtitle-analysis purpose, but its recommended install downloads executable code from a mutable GitHub branch without integrity verification.

Review before installing. Prefer using the packaged script as reviewed, or install only from a pinned commit or release with a checksum. Be aware the tool can read subtitle files or a chosen folder, fetch subtitles for user-supplied YouTube URLs, and write analysis files locally.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Error

Location: SKILL.md:20
Finding: Unverified Mutable Remote Script Retrieval Creates a Post-Review Code Execution Channel
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Rogue AgentSelf-Modification, Session Persistence
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The declared behavior says the skill summarizes and analyzes content, but the associated behavior reportedly only generates a template, includes raw text/statistics, and performs network retrieval via yt-dlp without declaring that capability. This is dangerous because users and orchestrators may trust the skill with broader data access or networking than expected, creating both integrity issues and an opportunity for unreviewed external fetches.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill instructs the agent/user to download files, create directories, and run a Python script, but it declares no explicit tool scope or permissions. That mismatch weakens security boundaries because a host may permit file and shell actions without clear user-visible authorization, increasing the chance of unintended filesystem changes or command execution.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description and README content are written entirely in Vietnamese, and the examples/instructions assume Vietnamese usage without any opt-in or alternative language option. This can violate language/locale policy when a skill implicitly restricts interaction to a specific language without documenting that constraint as intentional or region-specific.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 84% confidence
Finding: The skill instructs persistent installation into ~/.agents/skills and stores executable/script content there for future sessions. Persistence increases risk because a fetched or later-modified script can continue to be available across sessions, making accidental trust or long-lived compromise more likely, especially when installation pulls remote content directly from the network.
Content: Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.
bash
# macOS / Linux mkdir -p ~/.agents/skills/youtube-content-analyzer/scripts curl -o ~/.agents/skills/youtube-content-analyzer/SKILL.md \ https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-content-analyzer/SKILL.md curl -o ~/.agents/skills/youtube-content-analyzer/scripts/analyze_content.py \

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
bash
# macOS / Linux mkdir -p ~/.agents/skills/youtube-content-analyzer/scripts curl -o ~/.agents/skills/youtube-content-analyzer/SKILL.md \ https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-content-analyzer/SKILL.md curl -o ~/.agents/skills/youtube-content-analyzer/scripts/analyze_content.py \ https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-content-analyzer/scripts/analyze_content.py

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The document's instructions are written entirely in Vietnamese and direct the agent to produce specific sections in that language, such as 'Tóm tắt', 'Chủ đề chính', and 'Đánh giá mật độ thông tin'. This imposes a language choice on the user without offering an alternative or explaining a region-specific requirement, which is a natural-language locale policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script defaults subtitle handling to "vi,en" in both the function signature and CLI argument, which imposes a specific language/locale preference. This is a natural-language policy issue because the user is not explicitly offered a neutral default or asked to opt into that locale choice.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/analyze_content.py (reported line 114)May include surrounding context.
python
"-o", os.path.join(tmpdir, "%(title)s.%(lang)s.%(ext)s"), url ] subprocess.run(cmd, check=False) srt_files = list(Path(tmpdir).glob("*.srt")) if not srt_files:

Static analysis

No suspicious patterns detected.