ClawHub
Back to skill

Security audit

Openclaw Youtube Transcript

Security checks for vulnerabilities and agentic risk

Overview

The skill can transcribe YouTube videos, but it automatically contacts the author's telemetry server and exposes the user's IP address on every run unless opted out.

Review this before installing. The transcription feature is straightforward, but running it will contact the author's telemetry endpoint over unencrypted HTTP unless DISABLE_TELEMETRY is set. Only use it if you are comfortable with that IP-address disclosure or can enforce telemetry opt-out in your environment.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/transcribe.py:67
Finding

Automatic Disclosure of User IP Address Through Unencrypted Telemetry

Content
View full analysis

Vulnerability Details

File Location: scripts/transcribe.py:67-73, 85
Vulnerability Type: Unnecessary plaintext telemetry and privacy data disclosure
Risk Level: Medium

Vulnerable Code

python
def send_telemetry():
    if os.environ.get("DISABLE_TELEMETRY"):
        return
    try:
        urllib.request.urlopen("http://openclaw-youtube-transcribe.eastus.cloudapp.azure.com/telemetry", timeout=3)
    except Exception:
        pass

The telemetry function is invoked by default before transcription:

python
args = parser.parse_args()

send_telemetry()
transcribe(args.url, args.language, args.output)

Technical Analysis

Every normal invocation sends an HTTP request to an author-controlled Azure endpoint unless the user has set DISABLE_TELEMETRY. The destination can observe the caller's public IP address, request time, and ordinary HTTP metadata.

This communication is not required to retrieve YouTube subtitles and therefore exceeds the minimum network access needed for the Skill's declared transcription functionality. It is opt-out rather than opt-in and uses plaintext HTTP instead of HTTPS. Consequently, network intermediaries can inspect or modify the request. Catching every exception without reporting it also makes the telemetry side effect difficult for users to observe.

SKILL.md:60-69 discloses that the IP address is collected and provides an opt-out mechanism. The reviewed implementation does not explicitly transmit the video URL, transcript, credentials, or environment-variable contents to the telemetry endpoint.

Attack Path

  1. A user or AI Agent runs the documented transcription command.
  2. main() calls send_telemetry() before performing the requested transcription.
  3. Unless DISABLE_TELEMETRY is set to a nonempty value, the script opens an unencrypted HTTP connection to the external Azure host.
  4. The endpoint receives the caller's public IP addr ...[truncated 964 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the telemetry request entirely because it is unnecessary for subtitle transcription.
  2. If analytics must be retained, disable them by default and require explicit, informed opt-in consent before the first transmission.
  3. Replace HTTP with HTTPS and enforce certificate validation.
  4. Publish the endpoint operator, precise collected fields, purpose, retention period, sharing policy, and deletion process.
  5. Minimize collected metadata and avoid persistent identifiers or cross-request correlation.
  6. Provide a command-line option that clearly controls telemetry instead of relying only on an environment variable.
  7. Inform users when telemetry is enabled and avoid silently suppressing all related errors.
  8. Add automated tests confirming that no analytics connection occurs under the secure default configuration.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill discloses that it sends the user's IP address to the skill author on each run, but this is not surfaced prominently in the description or usage guidance before activation. That creates a meaningful privacy risk because users may invoke the skill expecting only YouTube access, not third-party telemetry to the author, and broad triggers increase the chance of unintentional disclosure.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script presents itself purely as a transcription utility, but it also performs an outbound telemetry request that is not disclosed in the module docstring or CLI help. Hidden network behavior violates user expectations and can expose usage metadata or serve as a covert beacon, which is especially concerning in an agent skill context where users may not inspect source before execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The send_telemetry function makes an unsolicited HTTP request to an external host unrelated to the stated task of downloading subtitles and producing a transcript. Even if no explicit payload is sent, the request leaks IP address, timing, user-agent, and execution metadata to a third party, and the undisclosed nature makes the behavior more suspicious in a security review.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger phrase 'what does this video say' is broad enough to activate on generic video-related requests without clearly constraining execution to YouTube transcript extraction. Overbroad activation can cause the agent to invoke this skill unexpectedly, leading to unnecessary network access and data disclosure such as sending the user's IP to third parties.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger 'summarize / analyze this YouTube video' is too broad because it can match requests that do not specifically consent to transcript extraction or remote fetching via yt-dlp. In this skill, broad activation is more dangerous because use of the skill initiates external requests and the document states telemetry sends the user's IP to the skill author by default.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/transcribe.py (reported line 50)May include surrounding context.

python
]

        print(f"Fetching subtitles from: {url}", file=sys.stderr)
        result = subprocess.run(cmd, capture_output=True, text=True)
        if result.returncode != 0:
            print(f"Error: yt-dlp failed:\n{result.stderr}", file=sys.stderr)
            sys.exit(1)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The telemetry request occurs automatically with no prominent user disclosure, consent flow, or runtime notice. Lack of transparency around outbound communication is dangerous because it can conceal tracking or policy-violating data egress, particularly for utility scripts that users expect to operate locally except for their core service interactions.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The documentation states the skill collects ONLY the user's IP address and that no other data is collected, but it also instructs users to set DISABLE_TELEMETRY to opt out. Reading an environment variable is additional runtime data access beyond 'only IP address,' so the wording is not strictly accurate. This is a documentation-to-behavior contradiction rather than a pure omission because 'ONLY your IP address' is absolute language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The script defaults the subtitle language to "en" when the user does not specify a language. This imposes a language preference by default rather than prompting for or preserving user choice, which can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.