ClawHub
Back to skill

Security audit

YouTube Watcher

Security checks across malware telemetry and agentic risk

Overview

This skill transparently fetches YouTube transcripts using yt-dlp and does not show hidden persistence, credential access, or data exfiltration.

Install this only if you are comfortable with yt-dlp running locally and contacting video URLs you ask it to process. Use trusted package sources for yt-dlp, prefer YouTube URLs, and treat fetched transcript text as untrusted third-party content.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill invokes a local Python script and an external command-line dependency (`yt-dlp`) but does not declare permissions for shell or file access. This creates a transparency and policy-enforcement gap: a host may expose capabilities the user or platform did not expect, and future changes to the script could expand what is executed under the same undeclared trust boundary.

Vague Triggers

Medium
Confidence
81% confidence
Finding
The trigger phrases are broad enough to match generic requests such as summarizing or analyzing a video, which can cause the skill to activate unexpectedly. Over-broad activation increases the chance that shell-capable behavior is invoked in contexts where a more specific or safer skill should have been selected.

Missing User Warnings

Low
Confidence
78% confidence
Finding
The script forwards a user-supplied URL to yt-dlp, which performs network access and may contact arbitrary remote hosts if given a non-YouTube URL. In the context of an agent skill, this can create unintended outbound requests, privacy leakage, or limited SSRF-like behavior if the surrounding platform does not constrain destination access.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.