ClawHub
Back to skill

Security audit

Youtube Search Extractor

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to extract YouTube links as described, but its unpinned global browser dependency and retained page HTML make it worth reviewing before installation.

Install only if you are comfortable with a global, unpinned browser-automation tool being installed and executed on your machine. Prefer using a sandbox or disposable environment, pinning agent-browser to a reviewed version, installing it locally instead of globally, and deleting generated HTML files if they may contain personal YouTube page state or recommendations.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
package.json:8
Finding

Unpinned Globally Installed Executable Dependency

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (32)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 70)May include surrounding context.

md
- **`SKILL.md`** - 技能文档

Lp1

High
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The code creates an output file containing extracted links, which is a real file-write capability not covered by declared permissions. Even though the current filename is hardcoded and the observed behavior is benign, undeclared write access in a skill can enable unauthorized file creation, overwriting of user data, or persistence artifacts if the code is modified or reused in a broader context.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The code creates an output file containing extracted links, which is a real file-write capability not covered by declared permissions. Even though the current filename is hardcoded and the observed behavior is benign, undeclared write access in a skill can enable unauthorized file creation, overwriting of user data, or persistence artifacts if the code is modified or reused in a broader context.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
78% confidence
Finding

The script has shell-like execution capability through subprocess but the declared permissions apparently do not disclose that capability. In an agent or skill ecosystem, undisclosed process-execution ability weakens trust boundaries and can allow a skill to launch local programs unexpectedly, especially because it executes both 'agent-browser' and another Python script during installation testing.

Content

No source excerpt is available for this finding.

Lp1

High
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill performs live network access to YouTube through an external browser process, but the declared behavior emphasizes link extraction without clearly scoping or declaring that network capability. Undeclared network access weakens permission transparency and increases the risk of users or hosts executing code with broader connectivity than expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file contains contributor-facing natural-language instructions almost entirely in Chinese, but it does not indicate that the project is intentionally Chinese-only or provide an opt-in language choice. Under the policy, forcing a specific language without user choice is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
79% confidence
Finding

The README is predominantly written in Chinese and all usage examples, headings, and output samples assume Chinese-language interaction, while the skill name is bilingual and there is no stated opt-in or explanation that the skill is intended only for Chinese-speaking users. Under the policy, forcing a specific language or locale without user choice can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The manifest description and read_when triggers are written only in Chinese, which implicitly constrains use to a specific language without any user opt-in or alternative locale support. The policy requires flagging language or locale restrictions when the skill forces a specific language without offering choice or documenting a justified regional scope.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · test_from_file.py (reported line 52)May include surrounding context.

python
# 保存到临时文件
                output_file = "hydrasynth_test_links"
                timestamp = __import__('datetime').datetime.now().strftime("%Y-%m-%d %H:%M:%S")
                
                with open(f"{output_file}_links.txt", 'w', encoding='utf-8') as f:
                    f.write(f"# YouTube搜索结果：'hydrasynth 实战应用' ({timestamp})\n")

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file contains user-facing docstrings and console messages entirely in Chinese, including installation guidance and success/failure output. The applicable policy rule flags language or locale constraints when the skill imposes a specific language without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_installation.py (reported line 13)May include surrounding context.

python
print("🔍 检查agent-browser安装...")
    
    try:
        result = subprocess.run(['agent-browser', '--version'], capture_output=True, text=True)
        if result.returncode == 0:
            version = result.stdout.strip()
            print(f"✅ agent-browser已安装，版本: {version}")

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_installation.py (reported line 38)May include surrounding context.

python
try:
        # 运行简单搜索
        result = subprocess.run(
            ['python3', 'youtube_search_extractor.py', test_keyword, test_output, '--wait-time', '3', '--max-links', '3'],
            capture_output=True, text=True, timeout=60
        )

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This Python file contains its module docstring and all user-facing status/error messages in Chinese, which imposes a specific language on users. The file does not offer any language selection, fallback, or explanation that the skill is intentionally region-specific, so it violates the language/locale policy criterion.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_without_daemon.py (reported line 18)May include surrounding context.

python
try:
        # 关闭可能存在的浏览器实例
        subprocess.run(['agent-browser', 'close'], capture_output=True, text=True)
        
        # 使用独立会话测试
        result = subprocess.run(

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · youtube_search_extractor.py (reported line 240)May include surrounding context.

python
try:
        # 关闭可能存在的浏览器实例
        subprocess.run(['agent-browser', 'close'], capture_output=True, text=True)
        
        # 使用独立会话测试
        result = subprocess.run(

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest describes a skill for searching YouTube and extracting video links, but this file invokes an external agent-browser CLI to close browser instances, open a session, and fetch page HTML. Spawning subprocesses to control an external browser is a broader capability than straightforward extraction logic and is not justified by the manifest description alone.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_without_daemon.py (reported line 21)May include surrounding context.

python
subprocess.run(['agent-browser', 'close'], capture_output=True, text=True)
        
        # 使用独立会话测试
        result = subprocess.run(
            ['agent-browser', '--session', 'test-session', 'open', 
             f"https://www.youtube.com/results?search_query={test_keyword}"],
            capture_output=True, text=True, timeout=30

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_without_daemon.py (reported line 34)May include surrounding context.

python
time.sleep(3)
            
            # 获取页面内容
            result = subprocess.run(
                ['agent-browser', '--session', 'test-session', 'get', 'html', 'body'],
                capture_output=True, text=True, timeout=30
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · test_without_daemon.py (reported line 100)May include surrounding context.

python
finally:
        # 清理资源
        try:
            subprocess.run(['agent-browser', '--session', 'test-session', 'close'], 
                         capture_output=True, text=True, timeout=10)
        except:
            pass

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

This Python test file contains natural-language strings such as the module docstring and test docstrings exclusively in Chinese. Under the stated policy, forcing a specific language without user opt-in or a documented justification is a locale-policy violation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding

For a simple link-extraction task, controlling an external browser process via subprocess introduces unnecessary attack surface and trust in a separate executable. If the browser tool is compromised, misconfigured, or granted broad session access, the skill could retrieve or expose more content than intended and operate with the browser's existing authenticated state.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · youtube_search_extractor.py (reported line 28)May include surrounding context.

python
try:
            # 关闭现有的浏览器实例
            subprocess.run(self.agent_browser_cmd + ['close'], capture_output=True, text=True)
            
            # 打开搜索页面
            search_url = f"https://www.youtube.com/results?search_query={self._url_encode(search_query)}"

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · youtube_search_extractor.py (reported line 34)May include surrounding context.

python
search_url = f"https://www.youtube.com/results?search_query={self._url_encode(search_query)}"
            print(f"📌 访问搜索页面: {search_url}")
            
            result = subprocess.run(
                self.agent_browser_cmd + ['open', search_url],
                capture_output=True, text=True, check=True
            )

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · youtube_search_extractor.py (reported line 47)May include surrounding context.

python
time.sleep(self.wait_time)
                
                # 获取页面HTML内容
                result = subprocess.run(
                    self.agent_browser_cmd + ['get', 'html', 'body'],
                    capture_output=True, text=True, check=True
                )

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The skill claims to extract video links but also writes the full retrieved YouTube search-result HTML to disk. Persisting much more data than necessary expands privacy and data-retention risk, especially if the page contains user-specific state, tokens, recommendations, or other incidental content from the browser session.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.