ClawHub
Back to skill

Security audit

YouTube Publisher

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent YouTube uploader, but it needs Review because it requests broad YouTube OAuth authority and stores a refreshable account token locally without enforcing restrictive file permissions.

Install only if you are comfortable granting this skill meaningful YouTube account access. Before use, review the Google OAuth consent scopes, run dependencies in a virtual environment, keep client_secret.json and token.json private with restrictive permissions, explicitly confirm channel/account and privacy setting before each upload, and revoke the Google OAuth grant if you stop using the skill or suspect token exposure.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
scripts/youtube_upload.py:36
Finding

OAuth Authorization Requests Excessive YouTube Account Privileges

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/youtube_upload.py:106
Finding

Refreshable OAuth Token Is Written Without Enforced Restrictive Permissions

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
SKILL.md:66
Finding

Third-Party Python Dependencies Are Installed Without Version or Integrity Pinning

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
85% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

5. Token 过期

脚本会自动刷新 Token。如果持续失败，删除 token.json 重新授权：

bash
rm ~/.openclaw/workspace/skills/youtube-publisher/token.json
python3 {baseDir}/scripts/youtube_upload.py auth

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md
前提:
  1. pip3 install google-api-python-client google-auth-oauthlib
  2. 从 Google Cloud Console 下载 OAuth 凭证文件 (client_secret.json)
  3. 放置到 ~/.openclaw/workspace/skills/youtube-publisher/client_secret.json
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md
前提:
  1. pip3 install google-api-python-client google-auth-oauthlib
  2. 从 Google Cloud Console 下载 OAuth 凭证文件 (client_secret.json)
  3. 放置到 ~/.openclaw/workspace/skills/youtube-publisher/client_secret.json
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md
前提:
  1. pip3 install google-api-python-client google-auth-oauthlib
  2. 从 Google Cloud Console 下载 OAuth 凭证文件 (client_secret.json)
  3. 放置到 ~/.openclaw/workspace/skills/youtube-publisher/client_secret.json
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youtube_upload.py (reported line 19)May include surrounding context.

python
前提:
  1. pip3 install google-api-python-client google-auth-oauthlib
  2. 从 Google Cloud Console 下载 OAuth 凭证文件 (client_secret.json)
  3. 放置到 ~/.openclaw/workspace/skills/youtube-publisher/client_secret.json
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youtube_upload.py (reported line 20)May include surrounding context.

python
前提:
  1. pip3 install google-api-python-client google-auth-oauthlib
  2. 从 Google Cloud Console 下载 OAuth 凭证文件 (client_secret.json)
  3. 放置到 ~/.openclaw/workspace/skills/youtube-publisher/client_secret.json
"""

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/youtube_upload.py (reported line 34)May include surrounding context.

python
前提:
  1. pip3 install google-api-python-client google-auth-oauthlib
  2. 从 Google Cloud Console 下载 OAuth 凭证文件 (client_secret.json)
  3. 放置到 ~/.openclaw/workspace/skills/youtube-publisher/client_secret.json
"""

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
95% confidence
Finding

The skill documents capabilities that require network access and local file writes, but it does not declare any explicit tool scope or permission boundaries. In an agent environment, this increases the chance that the skill can be invoked with broader-than-expected authority, reducing reviewability and user awareness of what the skill may access or modify.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill describes upload functionality but does not prominently warn that video files and metadata are sent to YouTube using OAuth-authenticated API calls and may be published publicly if the privacy flag is set accordingly. This weakens informed consent and increases the risk of users unintentionally disclosing sensitive media or metadata.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The invocation example uses broad natural-language phrasing like '帮我把 ... 上传到 YouTube' without requiring confirmation of privacy state, destination account, or publication intent. In agentic use, this can trigger high-impact actions from casual prompts and lead to accidental uploads or public disclosure of media.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The upload function hard-codes the default language parameter to "zh-Hans", which causes uploads to be tagged with a specific language unless the user explicitly overrides it. This is a natural-language locale policy concern because the script imposes a language default rather than making language selection neutral or opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The command-line interface sets --language to zh-Hans by default, so users who do not notice or supply the flag will have their content labeled as Chinese. This enforces a specific locale without opt-in and matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.