ClawHub
Back to skill

Security audit

YouTube Subtitle Extractor

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims, but its recommended install path downloads executable code from a mutable GitHub branch without integrity checks.

Review before installing. Prefer the packaged, reviewed script over the GitHub curl/Invoke-WebRequest install commands, or pin the download to a trusted commit and verify checksums. Use only trusted YouTube URLs, avoid dash-prefixed or unusual inputs, and set --limit for channel URLs to control runtime and disk usage.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:15
Finding

Mutable Remote Python Payload Downloaded Without Integrity Verification

Content
View full analysis
``` Consequently, the effective code executed by a user can change after this audited package has been reviewed. HTTPS protects data in transit but does not guarantee that the repository owner, repository account, branch contents, or hosting account will remain trustworth ...[truncated 1825 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/extract_subtitles.py:25
Finding

Untrusted URL Can Be Interpreted as a yt-dlp Command-Line Option

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill instructs users to download and run a Python script, write files into a persistent skill directory, and invoke shell commands, but it does not declare any tool scope or permissions metadata. This creates a transparency and governance gap: an agent or user cannot easily determine the intended file/system/network capabilities before installation, increasing the risk of overbroad execution and unsafe automation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
84% confidence
Finding

The installation instructions persist the skill under ~/.agents/skills and save a remotely fetched Python script for later execution. Persisting executable content across sessions increases risk because a compromised or later-modified skill remains available for future runs, and the markdown does not include integrity verification, pinning, or trust controls.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

bash
# macOS / Linux
mkdir -p ~/.agents/skills/youtube-subtitle-extractor/scripts
curl -o ~/.agents/skills/youtube-subtitle-extractor/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-subtitle-extractor/SKILL.md
curl -o ~/.agents/skills/youtube-subtitle-extractor/scripts/extract_subtitles.py \

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

bash
# macOS / Linux
mkdir -p ~/.agents/skills/youtube-subtitle-extractor/scripts
curl -o ~/.agents/skills/youtube-subtitle-extractor/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-subtitle-extractor/SKILL.md
curl -o ~/.agents/skills/youtube-subtitle-extractor/scripts/extract_subtitles.py \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-subtitle-extractor/scripts/extract_subtitles.py

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/extract_subtitles.py (reported line 44)May include surrounding context.

python
print(f"[*] Đang tải phụ đề từ: {url}")
    print(f"[*] Ngôn ngữ: {langs} | Format: {fmt}")
    result = subprocess.run(cmd, capture_output=False, text=True)

    if result.returncode != 0:
        print(f"[!] Lỗi khi tải phụ đề")

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill states that if a channel URL is provided it will download subtitles for all videos in the channel, with only a brief note about an optional limit flag and no warning about potentially large numbers of files. That can lead to unbounded bulk file creation, disk usage, and long-running operations if triggered against large channels.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring presents its description in Vietnamese, and the runtime status/help strings throughout the script also use Vietnamese by default. This imposes a specific language on users without any opt-in or alternative locale selection, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.