ClawHub
Back to skill

Security audit

YouTube Subtitle Extractor

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims: it installs a YouTube subtitle extractor that uses yt-dlp and saves subtitle and plain-text files locally.

Install only if you are comfortable with a persistent local skill downloaded from the publisher's GitHub repository. Review the script if possible, use --limit for channel or playlist URLs, and choose/manage the Youtube_Subtitles output directory because transcript files can remain on disk.

SkillSpector

Vulnerability Patterns
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill invokes Python scripts, performs shell-based installation, and writes files under the user's home directory, yet it declares no permissions. This creates a transparency and consent problem: an agent or user may treat the skill as low-risk while it can execute code, read inputs, and persist data to disk.

Tp4

High
Category
MCP Tool Poisoning
Confidence
84% confidence
Finding
The documented behavior does not fully match the operational behavior: it can generate additional plain-text transcript artifacts, support formats beyond those advertised, and process channel/playlist URLs for bulk operations. Behavior mismatches are dangerous because they undermine informed consent and can hide larger-than-expected data generation or processing scope.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
Allowing channel URLs without a clear warning can trigger large batch subtitle downloads and substantial file creation. This can consume disk space, network bandwidth, and time unexpectedly, especially when used by an automated agent acting on a broad user request.

Session Persistence

Medium
Category
Rogue Agent
Content
```bash
# macOS / Linux
mkdir -p ~/.agents/skills/youtube-subtitle-extractor/scripts
curl -o ~/.agents/skills/youtube-subtitle-extractor/SKILL.md \
  https://raw.githubusercontent.com/mcbaivn/openclaw-skills-mcbai/main/skills/youtube/youtube-subtitle-extractor/SKILL.md
curl -o ~/.agents/skills/youtube-subtitle-extractor/scripts/extract_subtitles.py \
Confidence
76% confidence
Finding
The installation instructions persist the skill and executable script into ~/.agents/skills, creating durable agent capabilities across sessions. While this is common for skill installation, persistence increases risk because a fetched remote script remains available for future execution and may outlive the user's immediate intent.

Static analysis

No suspicious patterns detected.