Publora Youtube

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is a straightforward Publora-to-YouTube publishing guide, but users should verify posts, privacy, and API key handling before use.

Install/use this only if you intend to let the agent help publish or schedule YouTube videos through Publora. Keep the Publora API key private, and require confirmation of the exact video, channel, title/description, schedule, and privacy setting before any post is created.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used with the wrong channel, file, time, or privacy setting, the agent could schedule or publish unintended YouTube content.

Why it was flagged

The skill documents API calls that create and schedule YouTube posts through Publora. This is expected for the skill, but it can affect a real YouTube channel.

Skill content

const post = await fetch('https://api.publora.com/api/v1/create-post', { method: 'POST' ... platforms: ['youtube-UC_CHANNEL_ID'], scheduledTime: '2026-03-20T15:00:00.000Z' })

Recommendation

Before running these API calls, confirm the YouTube channel ID, video file, title/description, scheduled time, and privacy setting.

Low

#ASI03: Identity and Privilege Abuse

What this means

Anyone with the key may be able to use the Publora account permissions associated with it, including publishing or scheduling content.

Why it was flagged

The skill requires a Publora API key, which is expected for the integration but grants delegated authority to act through the Publora account.

Skill content

**Header:** `x-publora-key: sk_YOUR_KEY`

Recommendation

Use a properly scoped Publora key if available, avoid exposing it in shared chats or logs, and rotate it if it may have been disclosed.