Youtube Channel Monitor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:19 AM UTC
• Version: 1.0.0

Overview

The skill broadly matches its YouTube monitoring purpose, but it automatically publishes content externally using fixed credentials and persistent local tokens, so it needs review before installation.

Review and modify this skill before installing. Use your own Telegram bot token and channel, rotate the exposed token, decide whether public Telegraph posting and Jina translation are acceptable, and only enable the hourly cron job after confirming the destination, schedule, and stored token permissions.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/youtube-monitor.py:25

Finding

Hardcoded Telegram Bot Token Exposes Bot API Access

Content

View full analysis

Vulnerability Details

File Location: scripts/youtube-monitor.py, lines 25–28
Vulnerability Type: Hardcoded secret
Risk Level: High

Vulnerable Code

python

token = "8630160870:AAFFF8xPS0muOqg8LGgMI3HalEA7ubVRIF8"

url = f"https://api.telegram.org/bot{token}/sendMessage"
data = {
    "chat_id": TELEGRAM_CHANNEL,
    "text": message,
    "parse_mode": "Markdown"
}

Technical Analysis

A Telegram bot token is embedded directly in the distributed source code. This token functions as a bearer credential: possession of it is generally sufficient to authenticate requests to the Telegram Bot API without any additional proof of identity.

Anyone able to read the Skill package, source repository, archive, logs containing the source, or a deployed copy can extract and reuse the credential outside the intended monitoring workflow. Embedding the token also prevents effective separation between application code and deployment-specific secrets.

The network transmission to Telegram is part of the declared notification functionality. The vulnerability is not the use of the Telegram API itself, but the permanent disclosure of its authentication credential in source code.

Attack Path

1. An attacker obtains a copy of the Skill package or reads scripts/youtube-monitor.py.
2. The attacker extracts the hardcoded bot token.
3. The attacker submits authenticated requests directly to https://api.telegram.org/bot<token>/....
4. The attacker invokes API operations available to the bot, independently of the Skill.
5. If the bot has channel administration or posting permissions, the attacker abuses those permissions until the token is revoked.

Impact Assessment

The exposed credential may permit unauthorized use of the Telegram bot identity. Depending on the bot's configured permissions, an attacker may send fraudulent messages, spam users or channels, impersonate the legitimate notifica ...[truncated 333 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke the exposed token immediately through Telegram's bot-management interface and generate a replacement.
2. Remove the token from the source code and repository history.
3. Load the replacement from a dedicated secret manager or a protected environment variable, such as TELEGRAM_BOT_TOKEN.
4. Fail safely at startup if the secret is missing rather than falling back to an embedded credential.
5. Restrict the bot to the minimum Telegram permissions needed to post notifications to the designated channel.
6. Avoid printing the token or credential-bearing Telegram URLs in logs and exceptions.
7. Add automated secret scanning to the development and release process.
8. Review Telegram API activity and channel history for evidence of unauthorized use.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/youtube-monitor.py:149

Finding

Telegraph Access Token Is Stored Without Explicit Restrictive File Permissions

Content

View full analysis

Vulnerability Details

File Location: scripts/youtube-monitor.py, lines 149–161
Vulnerability Type: Insecure plaintext credential storage
Risk Level: Medium

Vulnerable Code

python

token_file = "/home/t/.openclaw/workspace/telegraph_token.json"
if os.path.exists(token_file):
    with open(token_file, 'r') as f:
        token_data = json.load(f)
        access_token = token_data.get("access_token")
else:
    # Create a new account
    resp = requests.post("https://api.telegra.ph/createAccount", json=account_data, timeout=10)
    if resp.status_code == 200:
        token_data = resp.json().get("result", {})
        access_token = token_data.get("access_token")
        with open(token_file, 'w') as f:
            json.dump(token_data, f)

Technical Analysis

The script writes the Telegraph account response, including its access_token, to a predictable plaintext file. The file is created with Python's ordinary open(..., 'w') operation and therefore relies entirely on the process's current umask for permissions.

If the runtime environment has a permissive umask, the workspace is shared, or backups and diagnostics collect workspace files, users or processes outside the intended trust boundary may be able to read the credential. The predictable path also simplifies credential discovery after limited local access is obtained.

Persisting the token is necessary for reusing the Telegraph account, but storing it without explicitly enforcing owner-only access exceeds the minimum safe privilege exposure required for that functionality.

Attack Path

1. The Skill creates or reuses /home/t/.openclaw/workspace/telegraph_token.json.
2. The file is created under the process's default umask, without an explicit owner-only mode.
3. A local user, unrelated process, workspace reader, backup operator, or compromised component obtains read access to the file.
4. The attacker extract ...[truncated 943 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer storing the Telegraph access token in an operating-system credential store or dedicated secret manager.
2. If a file is required, create it atomically with mode 0600, rather than relying on the ambient umask.
3. Ensure /home/t/.openclaw/workspace and relevant parent directories are accessible only to the service account.
4. Verify and correct permissions when reading an existing token file; reject files owned by another user or writable by a group or other users.
5. Avoid storing the entire account response when only the access token and essential metadata are needed.
6. Exclude the token file from source control, diagnostics, archives, and unprotected backups.
7. Use a temporary file with restrictive permissions followed by an atomic rename to prevent partial writes and unsafe replacement.
8. Rotate the Telegraph token if the existing file may have been exposed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The documented purpose understates several sensitive behaviors: publishing to external services using bound credentials, transmitting content to an additional third-party translation service, and reading/writing local state and token files. This mismatch is dangerous because users may authorize or invoke the skill for summarization without understanding that their content and local resources will be sent externally and persisted using specific secrets or targets.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 65)May include surrounding context.

python

channel_url
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, env={**os.environ, "HTTP_PROXY": "http://127.0.0.1:7897", "HTTPS_PROXY": "http://127.0.0.1:7897"})
        if result.returncode != 0:
            print(f"Error fetching videos: {result.stderr}")
            return []

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares operational behavior that clearly requires filesystem, shell, network, and likely environment access, but it does not declare any permission or allowed-tools scope. This weakens reviewability and can cause the skill to run with broader-than-expected capabilities, making sensitive file access, network exfiltration, or command execution harder for users and platform controls to evaluate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill advertises automatic Telegraph publication and Telegram pushing without clearly warning that processed content will be transmitted to external services. In this context, subtitle text and generated summaries may contain copyrighted, private, or sensitive material, so undisclosed outbound transfer creates meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The description says the skill generates '中文专栏文章', and the workflow later states that English subtitles are automatically translated into Chinese. This imposes a specific output language by default without indicating user choice, opt-in, or a justified locale restriction.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The listed trigger scenarios are framed as general user intents such as wanting to subscribe to a YouTube channel or convert video content into text summaries, without clear boundaries on when this skill should activate instead of more general assistant behavior. The file does not provide exclusion conditions or negative examples to narrow invocation scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The workflow states that English subtitles are automatically translated into Chinese without documenting user opt-in, and the static findings indicate translation may involve an external service. That combination matters because it can silently transmit full subtitle content to a third party, increasing privacy, copyright, and data-handling risk beyond simple local summarization.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cron instructions configure recurring execution of a local Python script and send results to an external Telegram delivery target, but they do not clearly warn the user that this creates persistent automated behavior and outbound notifications. In this skill’s context, the automation is expected, but the lack of explicit consent and notice increases the risk of unintended monitoring, repeated network activity, and data disclosure to the configured channel.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Natural-language strings and logic indicate the script is designed to translate English subtitles into Chinese and publish Chinese-language output by default. There is no opt-in, configuration switch, or documented justification for forcing a specific language/locale, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script hardcodes a live Telegram bot token in source code, exposing a reusable secret to anyone who can read the file or logs. That token can be abused to send unauthorized messages, impersonate the bot, or pivot into other bot-managed workflows and channels.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

This Telegram API usage includes a bot token directly in the request URL, which means the secret is embedded in code and may leak through source sharing, stack traces, process inspection, or logging. Exposure of the token enables unauthorized use of the bot and compromise of the notification channel's integrity.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 27)May include surrounding context.

python

import requests
        token = "8630160870:AAFFF8xPS0muOqg8LGgMI3HalEA7ubVRIF8"
        
        url = f"https://api.telegram.org/bot{token}/sendMessage"
        data = {
            "chat_id": TELEGRAM_CHANNEL,
            "text": message,

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 33)May include surrounding context.

python

"text": message,
            "parse_mode": "Markdown"
        }
        resp = requests.post(url, json=data, timeout=10)
        return resp.status_code == 200
    except Exception as e:
        print(f"Telegram send error: {e}")

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 65)May include surrounding context.

python

channel_url
    ]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120, env={**os.environ, "HTTP_PROXY": "http://127.0.0.1:7897", "HTTPS_PROXY": "http://127.0.0.1:7897"})
        if result.returncode != 0:
            print(f"Error fetching videos: {result.stderr}")
            return []

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This translation endpoint causes transcript content to be transmitted to an external service, which can expose monitored content beyond the user's environment. Because the skill automatically processes channel updates, the risk is amplified by unattended bulk forwarding of data that users may not expect to leave the system.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 115)May include surrounding context.

python

"""用 Jina API 翻译成中文"""
    try:
        import requests
        url = "https://api.jina.ai/v1/translate"
        headers = {"Content-Type": "application/json"}
        data = {
            "source_lang": "en",

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

This code sends transcript and message data to Jina, Telegraph, Telegram, and YouTube-related services, and also writes state and token files locally. While there are internal comments and status prints, there is no clear user-facing warning that the script uploads content externally and persists data to disk, which is safety-relevant for a monitoring script.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The script sends transcript text to a third-party translation API, potentially disclosing video-derived content outside the local environment. In a monitoring skill that processes arbitrary subscribed channels, this can leak private, copyrighted, or sensitive material without explicit user review or data-minimization controls.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 122)May include surrounding context.

python

"target_lang": "zh",
            "text": text[:5000]  # 限制长度
        }
        response = requests.post(url, json=data, headers=headers, timeout=30)
        if response.status_code == 200:
            return response.json().get("data", {}).get("translated_text", text)
    except Exception as e:

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 174)May include surrounding context.

python

access_token = token_data.get("access_token")
        else:
            # 创建新账号
            resp = requests.post("https://api.telegra.ph/createAccount", json=account_data, timeout=10)
            if resp.status_code == 200:
                token_data = resp.json().get("result", {})
                access_token = token_data.get("access_token")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 194)May include surrounding context.

python

access_token = token_data.get("access_token")
        else:
            # 创建新账号
            resp = requests.post("https://api.telegra.ph/createAccount", json=account_data, timeout=10)
            if resp.status_code == 200:
                token_data = resp.json().get("result", {})
                access_token = token_data.get("access_token")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 174)May include surrounding context.

python

access_token = token_data.get("access_token")
        else:
            # 创建新账号
            resp = requests.post("https://api.telegra.ph/createAccount", json=account_data, timeout=10)
            if resp.status_code == 200:
                token_data = resp.json().get("result", {})
                access_token = token_data.get("access_token")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 174)May include surrounding context.

python

access_token = token_data.get("access_token")
        else:
            # 创建新账号
            resp = requests.post("https://api.telegra.ph/createAccount", json=account_data, timeout=10)
            if resp.status_code == 200:
                token_data = resp.json().get("result", {})
                access_token = token_data.get("access_token")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 194)May include surrounding context.

python

access_token = token_data.get("access_token")
        else:
            # 创建新账号
            resp = requests.post("https://api.telegra.ph/createAccount", json=account_data, timeout=10)
            if resp.status_code == 200:
                token_data = resp.json().get("result", {})
                access_token = token_data.get("access_token")

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/youtube-monitor.py (reported line 194)May include surrounding context.

python

"content": json.dumps(content)
        }
        
        resp = requests.post("https://api.telegra.ph/createPage", json=page_data, timeout=30)
        if resp.status_code == 200:
            result = resp.json().get("result", {})
            return result.get("url")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

A language-specific document can violate organizational language/locale policy when it implicitly forces one language for all users without opt-in or justification. Here, all headings and notes are Chinese-only, and there is no indication that the skill is region-specific or that other language options are available.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The module documentation says the script extracts subtitles and generates summaries, implying substantive summarization. In practice, create_article selects the first transcript paragraphs up to a length cap and posts them, which contradicts the stated behavior at the intent/documentation level.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.