ClawHub
Back to skill

Security audit

Youtube Publishing And Metadata

Security checks across malware telemetry and agentic risk

Overview

This skill is a clearly scoped YouTube metadata and publishing helper, with its publishing-related actions disclosed and bounded to the expected workflow.

Before installing, confirm you want an agent to help prepare YouTube publish metadata and configuration. Review privacy and madeForKids decisions carefully because they affect public visibility, channel features, and legal compliance.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
82% confidence
Finding
This is a JSON manifest-like file, so vague trigger review applies. The example input "Write the metadata for my YouTube video." is fairly broad and does not define any constraints, exclusions, or activation boundaries, which could cause the skill to match common requests that are not specifically intended for this skill.

Vague Triggers

Medium
Confidence
79% confidence
Finding
The phrase "Set up this YouTube upload." is generic and does not clearly distinguish metadata configuration from video creation, thumbnail handling, or full publishing workflows. Without explicit scope constraints in the trigger examples, the skill may be invoked for adjacent tasks handled by other skills or by native YouTube Studio.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.