Boring YouTube Publisher

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:55 AM UTC
• Version: 1.0.3

Overview

This skill is a disclosed YouTube publishing connector, but it uses a token-bearing MCP URL and can publish videos publicly without an explicit confirmation step in the skill instructions.

Install only if you trust Boring with access to your YouTube channel and uploaded media. Treat the MCP connector URL like a password, avoid pasting it into chats or public places, rotate or revoke it if exposed, and manually confirm the target account, title, media, captions, and visibility before any publish action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:10

Finding

Authentication Token Embedded in MCP Connector URL

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–30
Vulnerability Type: Credential exposure through a token-bearing URL
Risk Level: Medium

The Skill requires users to copy and paste an MCP Server URL containing an embedded authentication token:

yaml

requires:
  config:
    - MCP Connector link from boring.aiagent-me.com (contains embedded auth token)

markdown

- **MCP link is a credential**: Your MCP Server URL contains an embedded authentication token. Treat it like a password — do not share it publicly. Regenerate anytime in Settings.

markdown

3. **Get your MCP link**: Go to **Settings** → copy your MCP Server URL (contains your auth token — treat it like a password)
4. **Add to Claude**: Paste the MCP link as a Connector — no install, no API key needed

Technical Analysis

Embedding an authentication token in a URL creates a bearer-credential exposure risk. URLs may be retained in connector configuration, browser or application history, diagnostic reports, proxy logs, screenshots, chat transcripts, telemetry, and support bundles. Anyone who obtains the complete URL may be able to reuse its token without knowing a separate password.

The documentation recognizes that the URL is sensitive, but the warning does not remove the underlying insecure credential-transport and storage pattern. The risk is amplified because the connector is associated with a third-party service that holds authorization to interact with a connected YouTube account.

Attack Path

1. A user copies the token-bearing MCP URL as directed.
2. The URL is unintentionally retained in application configuration, logs, history, screenshots, exported conversations, diagnostics, or support material.
3. An attacker obtains the complete URL from one of these sources.
4. The attacker reuses the embedded bearer token to connect to the Boring MCP service.
5. Subject to the token's server-side scope and ...[truncated 956 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace authentication embedded in the URL with an Authorization header or another secret-bearing channel that is less likely to be recorded in URL logs and history.
2. Store connector credentials in the host platform's protected secret store rather than in ordinary connector text, chat history, or exported configuration.
3. Issue short-lived, narrowly scoped tokens and rotate them independently of the connector endpoint.
4. Provide immediate token revocation, session inventory, and rotation controls.
5. Redact query strings, path tokens, and complete connector URLs from logs, telemetry, diagnostics, error messages, and user interfaces.
6. Bind tokens to the minimum required operations and YouTube account, and require explicit user confirmation immediately before any publication.
7. Detect anomalous token reuse, new client locations, and unexpected publishing activity, then revoke affected sessions automatically.
8. Clearly document retention and deletion controls for uploaded videos, thumbnails, and captions, particularly because the Skill states that media is re-hosted using publicly accessible URLs.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 104)May include surrounding context.

md

- **Description max**: 5,000 characters
- **Thumbnail**: JPG/PNG, 1280x720 recommended, max 2MB
- **Captions**: SRT or VTT format
- **Token**: 1-hour access token with auto-refresh (refresh token never expires)
- **Default visibility**: Public
- **Processing**: After upload, YouTube may take minutes to process the video
- **Permissions**: `youtube.upload`, `youtube.readonly`

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill description uses broad trigger language such as 'wants to upload videos with titles, descriptions, tags, thumbnails, and captions to their YouTube channel,' which can cause the agent to invoke this skill in situations the user did not explicitly request. Over-broad activation increases the chance of unintended publication actions against a real YouTube account, especially because the skill performs an external side effect by uploading content publicly.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.