YouTube Scheduler

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:07 AM UTC
• Version: 1.0.0

Overview

The skill appears to perform YouTube schedule analysis, but its recommended install pulls executable agent files from an unpinned GitHub branch.

Review the exact code before installing, prefer a reviewed package or pinned commit over the provided main-branch download commands, and avoid running the analyzer on URLs you do not trust. The skill does not show credential theft, destructive behavior, or hidden execution in the inspected artifacts, but its install method needs careful handling.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:19
• Finding: Mutable Remote Payload Downloaded Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 19-20, 27-28, and 35-42 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```powershell Invoke-WebRequest -Uri "https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-scheduler/SKILL.md" -OutFile "$skillDir\SKILL.md" Invoke-WebRequest -Uri "https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-scheduler/scripts/analyze_schedule.py" -OutFile "$skillDir\scripts\analyze_schedule.py" ``` ```bash curl -o ~/.agents/skills/youtube-scheduler/SKILL.md \ https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-scheduler/SKILL.md curl -o ~/.agents/skills/youtube-scheduler/scripts/analyze_schedule.py \ https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-scheduler/scripts/analyze_schedule.py ``` ```powershell git clone https://github.com/mcbaivn/openclaw-skills-mcbai.git Copy-Item -Recurse openclaw-skills-mcbai\skills\youtube\youtube-scheduler $env:USERPROFILE\.agents\skills\ ``` ```bash git clone https://github.com/mcbaivn/openclaw-skills-mcbai.git cp -r openclaw-skills-mcbai/skills/youtube/youtube-scheduler ~/.agents/skills/ ``` ### Technical Analysis The recommended installation procedure downloads the Skill definition and executable Python script from the mutable `main` branch of a personal GitHub repository. It does not pin an immutable commit, select a signed release, or verify a cryptographic digest or signature. Consequently, the code installed by these commands can differ from the code that was statically audited. The packaged Python script inspected during this audit did not contain a malicious payload, but that does not establish the safety of future content returned by the remote mutable URLs. Remote retrieval is not necessary when the reviewed Skill package already contains ` ...[truncated 1343 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove remote-download installation instructions when the reviewed package already includes all required files. 2. If remote distribution is required, use an immutable commit URL rather than the mutable `main` branch. 3. Publish a SHA-256 digest through a separately authenticated channel and verify it before installing or executing the file. 4. Prefer signed, versioned releases and verify the release signature. 5. Ensure installation fails closed if checksum or signature verification fails. 6. Display and require approval for the exact version and source being installed. 7. Apply the same controls to both the executable script and `SKILL.md`, because Skill instructions can influence Agent behavior even without native code execution. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/analyze_schedule.py:24
• Finding: Unrestricted User-Supplied URL Passed to Network-Capable yt-dlp Process<![CDATA[ ## Vulnerability Details **File Location**: `scripts/analyze_schedule.py`, lines 24-34 and the command-line invocation near lines 136-144 **Vulnerability Type**: Insufficient URL validation and unintended outbound request risk **Risk Level**: Low ### Vulnerable Code ```python def fetch_video_schedule(url, limit=50): """Lấy thông tin upload_date và stats từ kênh""" cmd = [ "yt-dlp", "--flat-playlist", "--playlist-end", str(limit), "--print", '{"title":"%(title)s","view_count":%(view_count)s,"like_count":%(like_count)s,"upload_date":"%(upload_date)s","timestamp":%(timestamp)s,"channel":"%(channel)s"}', url ] result = subprocess.run(cmd, capture_output=True, text=True) ``` ```python parser = argparse.ArgumentParser(description="YouTube Scheduler Analyzer") parser.add_argument("url", help="URL kênh YouTube") parser.add_argument("--limit", type=int, default=50, help="Số video phân tích (mặc định: 50)") parser.add_argument("--tz", default="Asia/Ho_Chi_Minh", help="Timezone (mặc định: Asia/Ho_Chi_Minh)") args = parser.parse_args() print(f"[*] Đang lấy dữ liệu từ: {args.url}") videos = fetch_video_schedule(args.url, args.limit) ``` ### Technical Analysis The Skill declares that its positional argument is a YouTube channel URL, but it does not parse or validate the URL’s scheme, hostname, port, credentials, or resolved destination. The value is passed directly to `yt-dlp`, which is a network-capable utility supporting sources beyond YouTube. The use of a Python argument list rather than `shell=True` prevents conventional shell metacharacter injection. The issue is therefore not shell-command injection. The risk arises because an untrusted caller can choose the network destination contacted by `yt-dlp`, exceeding the minimum network scope needed to analyze a YouTube channel. In environments where an Agent can be induced to process attacker-selected input, this behavior may act as a limited server-s ...[truncated 1304 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Parse the input with `urllib.parse.urlsplit` before invoking `yt-dlp`. 2. Require HTTPS and allow only explicitly supported YouTube hostnames, such as `youtube.com`, `www.youtube.com`, `m.youtube.com`, and `youtu.be`. 3. Reject URLs containing embedded usernames or passwords, unexpected ports, malformed hostnames, or unsupported schemes. 4. Resolve the hostname and reject loopback, private, link-local, multicast, reserved, and unspecified IP address ranges. 5. Revalidate the destination after redirects or configure the retrieval layer to prohibit redirects outside the YouTube allowlist. 6. Apply outbound firewall or sandbox rules so the process can reach only required public YouTube endpoints. 7. Validate `--limit` against a reasonable positive range to reduce resource-exhaustion risk. 8. Preserve the existing argument-list subprocess invocation and do not introduce `shell=True`. ]]>

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill instructs users to download files from the network and run a Python script, but it does not declare any explicit tool scope such as shell, network, or file-write permissions. This creates a trust and review gap: an agent or operator cannot easily constrain what the skill is expected to do, and hidden or future changes in the fetched script could expand behavior without any manifest-level warning.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# macOS / Linux
mkdir -p ~/.agents/skills/youtube-scheduler/scripts
curl -o ~/.agents/skills/youtube-scheduler/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-scheduler/SKILL.md
curl -o ~/.agents/skills/youtube-scheduler/scripts/analyze_schedule.py \

• Confidence: 86% confidence
• Finding: The skill instructs creation of a persistent directory under ~/.agents/skills and stores executable content there, then directs the user to run that script later. Persisting remotely fetched code in a long-lived agent skill directory increases supply-chain and persistence risk because the code remains available across sessions and may be trusted or re-used without fresh review.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# macOS / Linux
mkdir -p ~/.agents/skills/youtube-scheduler/scripts
curl -o ~/.agents/skills/youtube-scheduler/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-scheduler/SKILL.md
curl -o ~/.agents/skills/youtube-scheduler/scripts/analyze_schedule.py \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-scheduler/scripts/analyze_schedule.py

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The module description and all user-facing help/report text are written in Vietnamese, and the default timezone is also set to a Vietnam-specific locale. This creates a language/locale policy concern because users are not given an opt-in or alternative language, and the file does not justify that the skill is intended only for Vietnamese-speaking or Vietnam-region use.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

"--print", '{"title":"%(title)s","view_count":%(view_count)s,"like_count":%(like_count)s,"upload_date":"%(upload_date)s","timestamp":%(timestamp)s,"channel":"%(channel)s"}',
        url
    ]
    result = subprocess.run(cmd, capture_output=True, text=True)
    videos = []
    for line in result.stdout.strip().split('\n'):
        if not line.strip():

• Confidence: 70% confidence
• Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The manifest describes a skill for analyzing a YouTube channel's posting schedule to identify optimal posting times, which implies read-only analytics over channel data. This code additionally creates a local directory and persists a report file to disk, a side effect not reflected in the stated skill description.

Static analysis

No suspicious patterns detected.