ClawHub
Back to skill

Security audit

Youtube Summarizer

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward YouTube transcript summarizer that uses disclosed network-dependent tools and does not show hidden data access, persistence, or destructive behavior.

Install only if you are comfortable with the agent contacting YouTube and installing Python tools such as youtube-transcript-api or yt-dlp. In sensitive environments, review the install commands first or preinstall the dependencies yourself.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill invokes external tools and Python packages that make outbound network requests to YouTube and package repositories, but the finding indicates those network capabilities are not explicitly declared as permissions. Undeclared network access weakens transparency and policy enforcement, making it harder to restrict or review what remote systems the skill can contact.

Static analysis

No suspicious patterns detected.