ClawHub
Back to skill

Security audit

YouTube Distiller

Security checks for vulnerabilities and agentic risk

Overview

The skill largely does what it advertises, but it ships an exposed MiniMax API key and under-discloses that video text is sent to an external AI service and saved locally.

Install only if you are comfortable sending video subtitles or transcript text to MiniMax and having summaries saved under the configured Windows directories and SumoNoteBook by default. The publisher should revoke and rotate the exposed MiniMax key before distribution, remove it from the artifact and history, and add a clear disclosure for external processing and local persistence.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
youtube-knowledge-dev.md:55
Finding

Hard-Coded MiniMax API Credential in Development Documentation

Content
View full analysis

Vulnerability Details

File Location: youtube-knowledge-dev.md, line 55
Vulnerability Type: Hard-coded API credential / plaintext secret exposure
Risk Level: High

Vulnerable Code Snippet

markdown
- API Key：`sk-cp-kL-C0rYerwRmd7yrI52akm6WfDLabsz3HfO7tQB2K1488-cwzmJ4rQNn-VcndSwEEy9EBxRlEFbZ8DhbYl_rOZ3uHuI3WI0vFysdtLfxi3sW2eLY`

Technical Analysis

A complete MiniMax API credential is embedded in a repository-tracked development document. Documentation files are commonly copied, archived, shared, indexed, and retained in version-control history. Consequently, removing the key only from the current file would not reliably invalidate copies that already exist.

The same document identifies the associated MiniMax API endpoint, making the credential straightforward to operationalize. An attacker does not need to exploit the Python application: possession of the repository is sufficient to extract the token and attempt direct authentication against the provider.

The audit cannot determine whether the credential remains active or what permissions, quota, or billing account it has. Nevertheless, a plaintext credential must be treated as compromised once committed or distributed.

Attack Path

  1. An attacker obtains read access to the project through a repository clone, archive, backup, artifact, log, or accidentally published directory.
  2. The attacker opens youtube-knowledge-dev.md and extracts the token from line 55.
  3. The attacker uses the documented MiniMax endpoint and supplies the extracted token as a bearer credential.
  4. If the credential remains valid, the attacker submits unauthorized API requests.
  5. The attacker may continue consuming the associated quota or incurring costs until the credential is revoked, expires, or is restricted by the provider.

Impact Assessment

Successful exploitation can permit unauthorized use of the MiniMax API within the exposed credential's assigned ...[truncated 465 chars]

Remediation
View remediation

Remediation Suggestions

  1. Revoke the exposed credential immediately through the MiniMax account console; do not merely delete it from the file.
  2. Generate a replacement credential only after revocation and store it in MINIMAX_API_KEY, a platform secret store, or a dedicated secrets manager.
  3. Remove the credential from the current document and replace it with a nonfunctional placeholder such as ${MINIMAX_API_KEY}.
  4. Purge the credential from all version-control history, release archives, build artifacts, backups, and copied documentation where feasible.
  5. Review provider-side usage and billing logs for unauthorized requests, unusual traffic, or unexpected charges.
  6. Apply least-privilege permissions, usage caps, expiration, and source restrictions to the replacement credential where supported.
  7. Add automated secret scanning to pre-commit hooks and CI pipelines, and block commits containing recognized API-token patterns.
  8. Document a credential-rotation and incident-response process for future exposures.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (18)

Tainted flow: 'headers' from os.getenv (line 166, credential/environment) → requests.post (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · youtube_distiller.py (reported line 181)May include surrounding context.

python
"temperature": 0.7
        }
        
        response = requests.post(API_URL, headers=headers, json=data, timeout=60)
        
        if response.status_code == 200:
            result = response.json()

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The document contains a hardcoded third-party API key directly in the skill development log. Exposed credentials can be reused by anyone who reads the file to access the external service, incur costs, exfiltrate data, or impersonate the project; this is especially dangerous because the documented feature only needs the endpoint documented, not a live secret embedded in markdown.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
78% confidence
Finding

The natural-language documentation and trigger example assume Chinese usage only, and there is no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-speaking context. Per the policy rule, forcing a specific language without user opt-in can be a language/locale policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

All visible natural-language instructions and examples are written in Traditional Chinese, including the invocation phrase, with no indication that other languages are supported or that this locale restriction is intentional. Under the policy, forcing a specific language without user opt-in or documented justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill states that it downloads subtitles from YouTube/Bilibili and uses the MiniMax API for summarization, but it does not warn users that third-party content will be retrieved and transmitted to an external AI provider. This creates a privacy and data-handling risk because users may provide private, unlisted, sensitive, or compliance-scoped material without understanding where the content is sent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill describes summarization via an external MiniMax API but does not clearly warn that subtitles, transcripts, or derived content may be transmitted off-device to a third party. Users may unknowingly send private or copyrighted content to an external provider, creating confidentiality, compliance, and privacy risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The documented use of an external API endpoint indicates data leaves the local environment for processing. In this skill's context, that external transmission is functionally expected, but it becomes security-relevant because the documentation lacks consent/privacy warning and is paired with an exposed API key, increasing the chance of unintended disclosure and misuse.

Content

Scanner excerpt · youtube-knowledge-dev.md (reported line 56)May include surrounding context.

md
### 使用工具
- **MiniMax M2.5 API**
- API Key：`sk-cp-kL-C0rYerwRmd7yrI52akm6WfDLabsz3HfO7tQB2K1488-cwzmJ4rQNn-VcndSwEEy9EBxRlEFbZ8DhbYl_rOZ3uHuI3WI0vFysdtLfxi3sW2eLY`
-VFHciOd API 網址：`https://api.minimax.io/v1/text/chatcompletion_v2`

### 支援的風格

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · youtube_distiller.py (reported line 36)May include surrounding context.

python
# API 設定（從環境變數讀取）
API_KEY = os.getenv("MINIMAX_API_KEY", "")
API_URL = "https://api.minimax.io/v1/text/chatcompletion_v2"

# 支援的風格
STYLES = {

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · youtube_distiller.py (reported line 91)May include surrounding context.

python
]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            log("字幕下載成功")
            return True

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · youtube_distiller.py (reported line 128)May include surrounding context.

python
cmd = [YT_DLP_PATH, "--dump-json", "--no-download", url]
    
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)
        if result.returncode == 0:
            import json
            info = json.loads(result.stdout)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The prompt explicitly instructs the model to always reply in Traditional Chinese, creating a language/locale constraint. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the restriction is clearly justified or the user is given a choice.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This code transmits full subtitle-derived content to an external API service, which can leak sensitive or proprietary information outside the local environment. In a content-distillation skill, that behavior is functionally expected, but it is still dangerous when not clearly disclosed and controlled because users may assume processing remains local.

Content

Scanner excerpt · youtube_distiller.py (reported line 181)May include surrounding context.

python
"temperature": 0.7
        }
        
        response = requests.post(API_URL, headers=headers, json=data, timeout=60)
        
        if response.status_code == 200:
            result = response.json()

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The script sends extracted subtitle text to a third-party AI API without explicit consent, warning, or a clear opt-in control at the point of use. Subtitles may contain private, copyrighted, or sensitive material, so silent external transmission creates a data exposure and compliance risk in this skill context.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The help text for '--no-whisper' says 'only use subtitles, do not use Whisper', and '--model' advertises a Whisper model size, which documents a fallback transcription path. In reality, the script only downloads subtitles, scans for VTT files, and terminates when none are found; no Whisper-related code path exists.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This markdown file states that the skill outputs UTF-8 text files to a default path, which affects user/system data by creating local files. Under the markdown criteria for missing user warnings, there is no explicit warning or disclosure about automatic file creation, overwrite behavior, or where data from processed videos will be stored.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
70% confidence
Finding

The entire skill description, trigger phrasing, and usage guidance are presented only in Traditional Chinese, with no indication that users may choose another language or that the locale limitation is intentional. This can constitute a language/locale policy issue when a skill implicitly forces one language without opt-in.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill writes output to local temp/output paths such as C:\temp\ without clearly warning users. Sensitive summaries or transcripts may be left on disk where other local users, backup systems, or later processes can access them unexpectedly.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
84% confidence
Finding

The docstring and function intent indicate reliable log updating, but in the 'else' branch for a missing log file the code sets 'new_entry' and then writes 'content' at L276 without assigning it first. This contradicts the function's stated behavior because the first-run path does not actually perform the documented update successfully.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.