ClawHub - YouTube Downloader & Clipper

• Analyzed: May 12, 2026, 3:17 AM
• Findings: 1
• Version: 1.1.1
• Hash: 110af7a1ee7d464d1859a502a8dc50d3f2668e04467a2384d7381013b1aef1f0
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious due to the agent being instructed to execute `pip install yt-dlp` in `prompt.md` if the module is not found. While `yt-dlp` is a legitimate package, granting the agent the capability to run `pip install` allows it to install arbitrary Python packages, which is a high-risk operation. Additionally, the agent is instructed to generate and execute Python code based on user input, which, despite instructions for filename sanitization, presents a significant attack surface if not perfectly secured by the agent's runtime environment.