ClawHub
Back to skill

Security audit

YouTube Transcript with Speaker Diarization

Security checks across malware telemetry and agentic risk

Overview

This skill is a straightforward YouTube transcript integration that sends user-provided video links to diarize.io using a documented API key, with no hidden persistence or unrelated host changes found.

Install only if you are comfortable sending the YouTube URL and transcript job data to diarize.io or to any base URL you configure. Avoid using it for private, confidential, or regulated video links unless that external processing is approved.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill sends YouTube URLs and related transcript request data to the third-party diarize.io API, but the user-facing description does not prominently warn about this data transfer. This can cause users or calling agents to disclose private, unlisted, or sensitive video references to an external service without informed consent, creating privacy and compliance risk.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The script transmits user-provided YouTube URLs, job identifiers, and resulting transcript data to diarize.io or another configured remote endpoint, but the script itself provides no explicit disclosure, confirmation, or trust boundary warning before doing so. In a skill context, this can expose sensitive video selections or transcript contents to a third-party service, especially because the base URL is configurable and could point to an unexpected host.

External Transmission

Medium
Category
Data Exfiltration
Content
local base_url="$5"

  if [[ -n "$body" ]]; then
    curl -fsS -X "$method" \
      -H "Authorization: Bearer $api_key" \
      -H "Content-Type: application/json" \
      "${base_url}${path}" \
Confidence
88% confidence
Finding
curl -fsS -X "$method" \ -H "Authorization: Bearer $api_key" \ -H "Content-Type: application/json" \ "${base_url}${path}" \ -d

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.