ClawHub
Back to skill

Security audit

Youtube Video Cellcog

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed CellCog integration for generating YouTube content, with privacy and cost caveats but no hidden or destructive behavior in the artifact.

Install only if you intend to send YouTube content requests to CellCog and are comfortable using a CELLCOG_API_KEY. Avoid including secrets, regulated data, or proprietary material in prompts unless your organization permits that use, and watch credit usage because the skill warns video generation can be expensive and unpredictable.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The description is very broad and frames the skill as generally applicable to many YouTube-related tasks without clear trigger boundaries or guardrails. In agent ecosystems, overly permissive descriptions can cause accidental invocation in unrelated contexts, increasing the chance that user data or prompts are sent to an external service when the user did not intend that behavior.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill requires an API key and routes prompts to an external provider, but the markdown does not clearly warn users that their inputs and possibly attached content may leave the local environment. This creates a privacy and compliance risk, especially if users include sensitive scripts, internal plans, unpublished media concepts, or proprietary material in prompts.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.