YouTube Publisher

ReviewAudited by ClawScan on May 10, 2026.

Overview

This appears to be a real YouTube uploader, but it requests broad persistent YouTube OAuth permissions, so users should review it carefully before authorizing it.

Only authorize this skill if you are comfortable giving it durable access to your YouTube channel. Review the Google OAuth consent screen, keep uploads private by default, and consider narrowing the OAuth scopes or using a dedicated channel/project for automation.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Concern

ASI03: Identity and Privilege Abuse

What this means

If the token is misused by the agent environment or another local process, it could affect the user's YouTube channel beyond a single upload.

Why it was flagged

The skill persists OAuth credentials and requests broad YouTube account scopes, not only a narrow upload permission. This grants durable authority over the user's YouTube account if authorized.

Skill content

TOKEN_FILE = os.path.join(SKILL_DIR, "token.json")
SCOPES = [
    "https://www.googleapis.com/auth/youtube.upload",
    "https://www.googleapis.com/auth/youtube",
    "https://www.googleapis.com/auth/youtube.force-ssl",
]

Recommendation

Use a dedicated Google project/account where possible, review the OAuth consent scopes before approving, and consider reducing the script scopes to the minimum needed for upload, thumbnail, and playlist operations.

Note

ASI02: Tool Misuse and Exploitation

What this means

A mistaken prompt or file selection could publish the wrong video or metadata to a public channel.

Why it was flagged

The skill can have the agent publish videos to YouTube, including public uploads. This is the stated purpose, but public publishing is a high-impact action.

Skill content

Agent 会自动调用上传脚本完成发布。 ... --privacy public

Recommendation

Keep the default private setting for first uploads, explicitly specify privacy, title, and file path, and manually review the video in YouTube Studio before making it public.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future dependency changes or a compromised package source could affect the local uploader environment.

Why it was flagged

The setup instructions install unpinned Python dependencies. This is a normal setup step for this integration, but versions and provenance are not locked in the artifact.

Skill content

pip3 install google-api-python-client google-auth-oauthlib google-auth-httplib2

Recommendation

Install dependencies in a virtual environment, use trusted package indexes, and pin known-good versions if using this skill in a production workflow.