Security audit

Youtube Video Publisher

Security checks for vulnerabilities and agentic risk

Overview

This YouTube publishing skill is mostly coherent, but it asks users to grant broad, long-lived publishing authority and has inconsistent disclosure around public uploads.

Review before installing. Use only with accounts you are comfortable granting publishing access to, avoid connecting unrelated social accounts, treat the MCP URL like a password, and confirm every video, channel, metadata field, staged media URL, and visibility before asking an agent to publish.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:20
Finding: Over-Scoped Bearer Credential Grants Cross-Platform Publishing Access
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:23
Finding: Misleading Data-Handling Disclosure for Public Third-Party Media Uploads
Content: View full analysis
", platform="youtube", text="Video Title\n\nDescription of the video\n\n#shorts #trending", media_urls=["https://...video.mp4", "https://...thumb.jpg"] ) ``` ### Technical Analysis The data-handling section says that only performance metrics are retrieved and that no content is uploaded or modified. However, the core workflow expressly uploads local videos to a third party, re-hosts remote videos, accepts Google Drive resources, and generates public URLs for videos, thumbnails, and captions. These statements describe materially different data flows. The workflow may copy private or unreleased content from the user's local filesystem or cloud storage to third-party infrastructure before YouTube publication. The document does not explain the media host, URL entropy, access controls, expiration, retention period, deletion process, geographic storage location, or whether public objects remain accessible after publication or cancellation. Use of public media URLs creates an additional disclosure surface because possession ...[truncated 1269 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:85
Finding: Public Video Publication Lacks a Mandatory Final Confirmation Gate
Content: View full analysis
", platform="youtube", text="Video Title\n\nDescription of the video\n\n#shorts #trending", media_urls=["https://...video.mp4", "https://...thumb.jpg"] ) ``` ``` The documented visibility behavior is: ```markdown - **Processing**: After upload, YouTube may take minutes to process the video - **Permissions**: `youtube.upload`, `youtube.readonly` ``` The same section also states: ```markdown - **Default visibility**: Public ``` ### Technical Analysis Publishing media is an externally visible, state-changing operation with potentially irreversible consequences. The workflow does not require a final preview or explicit confirmation after resolving the target account, media files, title, description, tags, captions, thumbnail, and visibility. Because publication defaults to Public, an interpretation error, incorrect account selection, unintended file choice, or malformed metadata can expose content immediately. Upload processing delays do not provide a documented approval window, and deleting a publication afterward may not undo copies, notifications, indexing, or third-party access. The absence of a confirmation gate is particularly significant for an AI-agent skill because natural-language requests can be ambiguous and account identifiers may not be meaningful to users without a human-readable channel preview. ### Attack Path 1. A user makes an ambiguous upload or preparation request, or the agent selects an incorrect file or YouTube account. 2. The agent lists accounts and prepares media URLs and metadata. 3. The wo ...[truncated 867 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The documentation makes a materially misleading claim that only analytics are retrieved and that no content is uploaded or modified, even though the skill’s core function is publishing videos to YouTube. This can cause users or downstream agents to authorize a high-privilege publishing connector under false assumptions, increasing the risk of unintended content publication and unsafe consent.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.
md
- **Description max**: 5,000 characters - **Thumbnail**: JPG/PNG, 1280x720 recommended, max 2MB - **Captions**: SRT or VTT format - **Token**: 1-hour access token with auto-refresh (refresh token never expires) - **Default visibility**: Public - **Processing**: After upload, YouTube may take minutes to process the video - **Permissions**: `youtube.upload`, `youtube.readonly`

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The documentation states that the embedded token can manage scheduled posts across connected social accounts, which is broader than the YouTube-only publishing workflow presented in the skill. This scope mismatch can mislead users about the breadth of authority they are granting and may normalize over-privileged credentials for a narrowly described task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The publish workflow does not warn before execution that uploads become public by default; that fact only appears later in reporting/notes. In a content-publishing skill, failing to foreground public visibility can lead to accidental disclosure of unreleased, private, or sensitive video content.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.