YouTube To Blog

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:24 AM UTC
• Version: 1.0.0

Overview

This skill does what it claims: it turns a YouTube URL or pasted transcript into a blog post, with no hidden code, persistence, credential use, or unrelated access in the inspected artifacts.

Before installing, consider pinning or verifying the ClawHub installer version instead of using @latest. When using the skill with a URL, expect the agent to contact YouTube's caption system; paste a transcript manually if you do not want URL-based retrieval.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:31

Finding

Unpinned npm Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: README.md:31-33
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable code:

bash

npx clawhub@latest install tetsuakira-vk/youtube-to-blog

Technical Analysis

The documented installation command directs npx to download and execute the mutable latest release of the clawhub npm package. The project does not pin an exact package version, provide an integrity hash, require signature verification, or include a lockfile that constrains the installer version.

Because the latest npm distribution tag can be reassigned, the code executed by this command may differ from the version reviewed when the documentation was published. This creates a supply-chain trust boundary in which compromise of the package publisher, npm account, registry, or a future package release could expose users to arbitrary code execution.

Attack Path

1. An attacker compromises the npm publisher account, publication pipeline, package registry entry, or another mechanism controlling the clawhub package.
2. The attacker publishes a malicious version and assigns it to the latest distribution tag.
3. A user follows the installation instructions and runs npx clawhub@latest install tetsuakira-vk/youtube-to-blog.
4. npx retrieves and executes the attacker-controlled package version.
5. The malicious package runs with the permissions of the invoking user and can access resources available to that account.

This is a conditional supply-chain exploitation path; the audited files do not establish that the current package is malicious.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's privileges. Depending on those privileges and the host configuration, an attacker could read or modify user-accessible files, steal environment variables or development credentials, alter installed skill ...[truncated 203 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, exact package version, for example:

  bash

  npx clawhub@X.Y.Z install tetsuakira-vk/youtube-to-blog
  

• Document the expected npm registry and official package provenance so users can verify that the package comes from the intended publisher.
• Publish and document cryptographic integrity information or package signatures where supported.
• Recommend reviewing the resolved package metadata and source before execution, particularly in privileged or CI environments.
• Avoid running the installer with elevated privileges.
• Establish a controlled update process in which new installer versions are reviewed before the documented version is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses npx clawhub@latest, which fetches and executes the latest published package version at install time rather than a reviewed, pinned version. If the upstream package is compromised or a breaking/malicious release is published, users could execute untrusted code simply by following the README instructions.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The usage trigger phrase is very broad: Use youtube-to-blog with this video: or ...with this transcript:. Broad activation language increases the chance the skill is invoked unintentionally by unrelated user content, prompt injection, or ambiguous natural-language references, especially in agentic environments that route tools based on freeform text.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill instructs the agent to fetch a YouTube transcript from a third-party service without telling the user that their provided URL will trigger a network request. This creates a transparency and privacy issue because user-supplied content may be transmitted externally or logged, even though the action is relatively low risk in this context since it targets public YouTube resources.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.