ClawHub
Back to skill

Security audit

YouTube Full Channel Transcripts

Security checks across malware telemetry and agentic risk

Overview

This skill coherently uses local yt-dlp and jq to fetch YouTube subtitles and save transcript exports, with no evidence of hidden data access or unsafe persistence.

Install only if you are comfortable running local yt-dlp and jq against YouTube. Use a trusted yt-dlp installation, limit max_videos for large channels, and set output_dir intentionally because the skill writes transcript exports there and may clear an existing transcripts.json or transcripts.csv file in that directory.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Missing User Warnings

Low
Confidence
84% confidence
Finding
This markdown file describes saving results to an output directory and producing JSON/CSV files, but it does not explicitly warn users that running the skill will create files in the workspace. For a skill that affects local data by writing exports, a brief disclosure helps users understand the side effect before invocation.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
esac

  SUCCESS_COUNT=$((SUCCESS_COUNT+1))
  rm -f "$SUBTITLE_FILE" "${SUBTITLE_FILE}.auto" 2>/dev/null || true
done < <(echo "$ENTRIES_JSON" | jq -c '.[]')

# Summary
Confidence
95% confidence
Finding
rm -f "$SUBTITLE_FILE" "${SUBTITLE_FILE}.auto" 2>/dev/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal