ClawHub
Back to skill

Security audit

YouTube Thumbnail

Security checks across malware telemetry and agentic risk

Overview

This skill transparently helps set YouTube thumbnails through the yutu CLI, with expected OAuth credential use that users should protect carefully.

Install only if you trust the yutu CLI and are comfortable granting it YouTube account access. Keep client_secret.json and youtube.token.json out of source control and shared folders, use restrictive file permissions, verify the thumbnail file and video ID before running the command, and revoke or delete the token when finished.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The setup guide instructs users to create and store OAuth client credentials and cached access tokens in local files, but it does not warn that these files are sensitive secrets that must not be committed, shared, or left with overly broad permissions. In a skill intended to manage YouTube accounts, these tokens can grant meaningful access to channel resources, so omitting secret-handling guidance increases the chance of credential leakage and account compromise.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.