Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marks this skill suspicious because scanners report an unauthenticated local file server, unclear upload authorization and triggers, and a mismatch between its stated podcast purpose and some documented actions.
Consider the suspicious verdict and the incomplete analysis before installing. Pay particular attention to the reported possibility that unrelated websites could read files being prepared for upload, and to the unclear conditions for starting uploads and sending notifications. The scan does not establish malicious intent, but it also does not establish that the skill is safe.
adapters/xiaoyuzhou/upload.jsUnauthenticated loopback file server permits reads from unrelated websites
An attacker can obtain the audio and optional cover before their intended publication, including content not yet approved or available publicly. This does not expose arbitrary filesystem paths.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
url = "https://i.ytimg.com/vi/%s/%s" % (video_id, name)
try:
request = urllib.request.Request(url, headers=headers)
with urllib.request.urlopen(request, timeout=30) as response:
payload = response.read()
except Exception as exc: # noqa: BLE001 - 封面失败不致命
log(job, "下载封面失败(%s): %s" % (name, exc))
虽然安装 CLI 可以是支持性实现细节，但登录并发布技能属于独立的分发行为，未被声明用途涵盖。此代码片段未执行 YouTube 处理、NotebookLM 音频生成、ffmpeg 转码、小宇宙上传或结果通知。该结论仅针对提供的 README 命令，不推断未展示的技能实现。
The command defaults draft to true and calls /v1/episode/hosted/publish only when draft is false. Consequently, uploading alone does not implement the declared automatic publication workflow. A caller could supply --publish, but no such orchestration is shown in this chunk. Local file access, the temporary loopback server, authenticated platform requests, and browser form automation support the declared upload purpose and are not independent mismatches. Because this is an upload adapter, the absence of YouTube processing, NotebookLM generation, ffmpeg transcoding, and notifications here does not by itself establish additional mismatches.
The instructions claim public release requires --publish plus an environment variable, yet default uploads enter a review process that can automatically publish without either control. Contradictory assurances that drafts are private can cause the agent or user to authorize what appears to be private processing but actually produces an irreversible public action.
Referenced artifact was not completely inspected
| `NEED_LOGIN` | NotebookLM / 小宇宙掉登录 | 先跑 `scripts/doctor.sh` 看是哪一侧掉了，登录后 `--rerun` |
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
}
/**
* The upload dialog is a Mantine modal whose content is mounted from a
* requestAnimationFrame driven transition. Chrome does not run rAF for hidden
* pages, so a backgrounded tab would leave the dialog empty forever.
*/
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
}
throw new CommandExecutionError(
'The Xiaoyuzhou podcaster page is not visible (Chrome window is minimised or another tab is in front)',
'The upload dialog of the podcaster backend only renders in a visible page. Bring the Chrome window to the front (or run the command with --window foreground) and retry.',
);
}
Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
const visibility = await evaluate(page, '(() => document.visibilityState)()');
if (visibility !== 'visible') {
throw new CommandExecutionError(
'The Xiaoyuzhou upload dialog stayed empty because the page is not visible',
'Bring the Chrome window to the front (or run the command with --window foreground) and retry.',
);
}
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
"""子进程环境:补上代理,让 Node fetch 走得通。"""
global CHILD_ENV, _PROXY_APPLIED
if CHILD_ENV is None:
env = dict(os.environ)
proxy = system_proxy()
if proxy:
for key in ("HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY"):
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
### Changed
- **公开发布改为双重显式授权**：`--publish` 且 `YT2PODCAST_ALLOW_PUBLISH=1`，缺一即报
`PUBLISH_NOT_ALLOWED`。回应安全扫描"public publishing can occur without explicit authorization"。
- **不再自行 detach 进程**：`new-job.sh` 只写 job 文件并打印下一步命令，移除了 setsid/nohup 启动路径。
回应"a worker can outlive the host's process cleanup"。
- 新增 `SECURITY.md`，逐项说明执行命令、网络、写入范围、发布授权、进程生命周期、无遥测。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
不会重复消耗 NotebookLM 生成配额。
> ⚠️ 关键坑：OpenClaw 的 exec 在回合结束时会 kill 整个进程组（日志里能看到
> `treeOwnership: process-group`）。普通 `nohup ... &` 起的 worker 会被立刻杀掉，
> job 永远停在第一个阶段，而且**不会**有失败通知。所以必须用宿主的 background 托管能力，
> 不要自己 detach。
The documented trigger treats receiving a YouTube link as authorization for generation and upload, without establishing that the user wants conversion or public distribution. Because the same source says uploaded episodes automatically become public after review, an ambiguous link-sharing message can cause an unintended external publication and consume generation quota.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## 已知坑（都已修，留档避免回归）
1. **worker 启动即被杀**：OpenClaw 的 exec 在回合结束时会 kill 整个进程组（`treeOwnership: process-group`），`nohup ... &` 不顶用，job 会永远停在第一阶段且**没有任何通知**。
→ 用 exec 的 `background: true` 托管；`new-job.sh` 的内部启动也加了 setsid 兜底。
2. **AddSources RPC 静默失败**：`youtu.be/xxx?si=...` 带追踪参数会让 NotebookLM 加源返回 no source id。
→ `canonical_youtube_url()` 统一成 `https://www.youtube.com/watch?v=<id>`。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## 已知坑（都已修，留档避免回归）
1. **worker 启动即被杀**：OpenClaw 的 exec 在回合结束时会 kill 整个进程组（`treeOwnership: process-group`），`nohup ... &` 不顶用，job 会永远停在第一阶段且**没有任何通知**。
→ 用 exec 的 `background: true` 托管；`new-job.sh` 的内部启动也加了 setsid 兜底。
2. **AddSources RPC 静默失败**：`youtu.be/xxx?si=...` 带追踪参数会让 NotebookLM 加源返回 no source id。
→ `canonical_youtube_url()` 统一成 `https://www.youtube.com/watch?v=<id>`。
3. **下载音频 `fetch failed`**：音频在 `lh3.googleusercontent.com`，国内直连超时；opencli 用 Node fetch，不读 macOS 系统代理。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Nothing is detached: `scripts/new-job.sh` only writes a job file and prints the next
command. The worker runs under whatever supervisor the caller uses (agent host, terminal,
system service) and exits with it. No cron/systemd/launchd entries are installed.
## Telemetry
Without declared permissions the skill's intent is opaque and cannot be validated.
Output size or generation rate is not bounded. Unbounded output enables denial-of-service through resource exhaustion, log flooding, or context-window stuffing.
* 2. the file is attached with a synthetic `DataTransfer` + `change` event,
* which is exactly what react-dropzone listens for;
* 3. the local file is served over a short-lived loopback HTTP server, so the
* browser reads it straight from disk (no base64 round trip, no size cap).
*
* Draft vs publish: creating an episode (POST /v1/episode/hosted/create-free)
* only produces an unpublished draft (status INITIALIZED, shown as 单集审核中 in
The manifest states that uploading enters platform review and automatically goes live after approval, with --hold-upload as the pre-upload stopping point. Instead, L692 defaults --draft to true, L723 preserves that default, and L792–L799 skip the publish request unless draft mode is explicitly disabled; the module documentation at L018–L021 likewise describes this default outcome as unpublished.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def worker_running(job_id: str) -> Optional[int]:
"""worker.py <job_id> 还在跑就返回 pid。"""
try:
out = subprocess.run(
["pgrep", "-f", r"worker\.py %s(\s|$)" % job_id],
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=10,
).stdout.decode()
The job_id read from a job file is inserted into a pgrep regular expression without validation or escaping. Someone able to influence that file can alter process matching and suppress recovery through false liveness results; this is regex injection affecting availability, not shell or Python code execution.
def worker_running(job_id: str) -> Optional[int]:
"""worker.py <job_id> 还在跑就返回 pid。"""
try:
out = subprocess.run(
["pgrep", "-f", r"worker\.py %s(\s|$)" % job_id],
stdout=subprocess.PIPE, stderr=subprocess.DEVNULL, timeout=10,
).stdout.decode()
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
tmp.write_text(json.dumps(job, ensure_ascii=False, indent=2) + "\n", encoding="utf-8")
os.replace(tmp, path)
print("[resume] %s -> %s" % (item["job_id"], target), file=sys.stderr)
code = subprocess.call([sys.executable, str(WORKER), item["job_id"]])
return code == 0
print("[dry-run] %s would resume at %s" % (item["job_id"], target), file=sys.stderr)
return True
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
if sys.platform != "darwin":
return None
try:
out = subprocess.run(
["scutil", "--proxy"], stdout=subprocess.PIPE, timeout=5
).stdout.decode("utf-8", "replace")
except (OSError, subprocess.SubprocessError):
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def run_cmd(args: List[str], timeout: int, cwd: Optional[str] = None) -> Tuple[int, str, str]:
"""执行外部命令,带超时;超时不抛 Python 异常,交给调用方判断。"""
try:
proc = subprocess.run(
args,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
def run_cmd(args: List[str], timeout: int, cwd: Optional[str] = None) -> Tuple[int, str, str]:
"""执行外部命令,带超时;超时不抛 Python 异常,交给调用方判断。"""
try:
proc = subprocess.run(
args,
stdout=subprocess.PIPE,
stderr=subprocess.PIPE,
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
output = Path(args[index + 1])
if output:
output.parent.mkdir(parents=True, exist_ok=True)
output.write_bytes(b"RIFF----WAVEfmt " + b"0" * 1024)
except OSError:
pass
return {"notebook_id": "dryrun-notebook-id", "file": "audio.wav", "bytes": 1024, "status": "done"}