ClawHub
Back to skill

Security audit

Youtube Long Form

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed YouTube long-form planning guide with a clearly scoped publishing handoff, not a hidden or self-executing automation.

Before installing, understand that this skill may guide an agent toward external scheduling and creative-tool workflows for YouTube. Use it when you want YouTube long-form strategy or scripts, and review any actual publish, delete, or scheduling action in the downstream scheduling tool before approving it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest description says to use the skill when someone asks to "grow my YouTube channel" or "get more views on my videos," which are broad natural phrases that could appear in many general coaching or marketing contexts. The file does not provide exclusion conditions or tighter activation boundaries beyond a general YouTube focus, so invocation scope remains somewhat ambiguous.

External Transmission

Medium
Category
Data Exfiltration
Content
## Publishing → scheduling-and-queue → WoopSocial
Route the finished video through **scheduling-and-queue**, which connects to WoopSocial via
**`tools/integrations/woopsocial.md`** (indexed in `tools/REGISTRY.md`).
- **Endpoints:** MCP `https://api.woopsocial.com/mcp` · REST `https://api.woopsocial.com/v1`.
- **YouTube is a supported platform** (one of 10, as of July 2026). Native scheduling; auto per-platform handling.
- **Lifecycle:** create / list / read / **validate** / delete. **No update** — editing = **delete +
  recreate**. Validate before publish.
Confidence
15% confidence
Finding
https://api.woopsocial.com/

External Transmission

Medium
Category
Data Exfiltration
Content
## Publishing → scheduling-and-queue → WoopSocial
Route the finished video through **scheduling-and-queue**, which connects to WoopSocial via
**`tools/integrations/woopsocial.md`** (indexed in `tools/REGISTRY.md`).
- **Endpoints:** MCP `https://api.woopsocial.com/mcp` · REST `https://api.woopsocial.com/v1`.
- **YouTube is a supported platform** (one of 10, as of July 2026). Native scheduling; auto per-platform handling.
- **Lifecycle:** create / list / read / **validate** / delete. **No update** — editing = **delete +
  recreate**. Validate before publish.
Confidence
15% confidence
Finding
https://api.woopsocial.com/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.