ClawHub
Back to skill

Security audit

YouTube Long Video Transcript

Security checks for vulnerabilities and agentic risk

Overview

This skill has a coherent YouTube transcript workflow, but it embeds a concrete bearer credential and should be reviewed before installation.

Review this skill before installing. Do not use the published bearer token; it should be revoked or rotated and replaced with a user-provided secret from a safe configuration source. Also confirm you are comfortable sending YouTube URLs and transcript requests to DownSub, optionally uploading the generated markdown through zhiyan, and creating local transcript files.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:19
Finding

Hard-Coded DownSub Bearer Credential

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–25
Vulnerability Type: Hard-coded secret in distributed Skill configuration
Risk Level: High

Vulnerable Code

markdown
**Endpoint**: `https://api.downsub.com/download`
**Method**: `POST`
**Headers**:

Authorization: Bearer AIzaM9ifctIOxusNAldvGeajHqq4rH6e7MJNfN Content-Type: application/json

text

Technical Analysis

The Skill embeds a bearer credential directly in its documentation and instructs agents to transmit it in the Authorization header when calling an external API. Because SKILL.md is distributed with the project, anyone who can read or obtain the package can extract and attempt to reuse the credential.

Bearer credentials grant access based on possession alone. There is no additional proof that the caller is the intended user. Although credential validity and server-side permissions cannot be confirmed from the reviewed file, the exposed value has the format and placement of an operational credential and must be treated as compromised.

Attack Path

  1. An attacker obtains or reads the distributed SKILL.md file.
  2. The attacker extracts the value from the Authorization: Bearer header.
  3. The attacker submits requests to the configured DownSub endpoint, or other endpoints that accept the same credential.
  4. If the credential remains valid, the external service associates those requests with the credential owner.
  5. The attacker consumes available quota or exercises any API permissions assigned to that credential until it is revoked, expires, or is restricted.

Impact Assessment

Successful exploitation may allow unauthorized use of the API permissions available to the exposed credential. The likely scope includes unauthorized subtitle-download requests, service-quota consumption, rate-limit exhaustion, and possible billing or operational impact. The maximum obtainable privileges are limited to those a ...[truncated 409 chars]

Remediation
View remediation

Remediation Suggestions

  1. Revoke and rotate the exposed credential immediately, even if it is believed to be inactive.
  2. Remove the credential from SKILL.md and all published copies, package releases, caches, logs, and version-control history.
  3. Obtain the credential at runtime from a protected secret manager or environment variable, such as DOWNSUB_API_KEY.
  4. Replace the example with a non-secret placeholder:
    http
    Authorization: Bearer ${DOWNSUB_API_KEY}
  5. Fail safely when the secret is absent; do not print the credential in errors, logs, generated documents, or agent responses.
  6. Apply provider-side restrictions where supported, including endpoint restrictions, minimal scopes, rate limits, expiration, and usage alerts.
  7. Add automated secret scanning to development and release workflows to prevent future credential inclusion.
  8. Review provider access logs for unauthorized requests made with the exposed credential and investigate anomalous quota or billing activity.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill embeds a concrete Bearer token directly in documentation, which is a real secret exposure. Anyone with access to the skill can reuse the credential to call the third-party API, potentially causing unauthorized usage, quota exhaustion, billing impact, or broader compromise if the token is tied to other Google-backed services.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description states the skill should translate English transcripts to Chinese, and later steps repeatedly instruct the agent to produce Chinese output. Because the file does not present this as an optional user-selected locale or justify it as a region-specific tool, it violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The workflow instructs agents to send YouTube URLs and transcript-related requests to DownSub without clearly warning the user that content will be transmitted to an external service. This creates a data-handling and privacy risk, especially if the user assumes processing is local or if URLs/transcripts are sensitive in context.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 18)May include surrounding context.

DownSub API Configuration

Endpoint: https://api.downsub.com/download Method: POST Headers:

text

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The sub-agent task says to translate to Chinese verbatim and generate a Chinese executive summary and metrics table, which is a hard-coded locale requirement. The policy requires either user opt-in or a clearly documented justification for such a language restriction.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The markdown directs the agent to create part1.md, merge files into full_transcript.md, and prepend generated content, which affects local user data and filesystem state. The skill description does not include an explicit warning that local files will be created and modified as part of execution.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:22