Youtube Master

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:59 AM UTC
• Version: 1.0.2

Overview

This is a coherent YouTube metadata and transcript helper, with credential and third-party API use that users should understand before installing.

Install only if you are comfortable providing a YouTube Data API key and, for transcripts, an Apify token. Prefer dedicated, revocable, least-privilege tokens, protect the local credentials file if you use it, and expect transcript requests to send the video URL to Apify. Environment variables may not work as documented because the script reads the local credentials file instead.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The skill recommends storing API secrets in a predictable credentials file path under the workspace. While documenting credential setup is normal, directing users to place high-value tokens in an accessible local file increases the risk of accidental exposure to other skills, processes, logs, backups, or misconfigured file permissions. In an agent ecosystem, shared workspace credential locations are especially sensitive because other components may be able to read them.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

Option 2: Credentials File (Recommended)

Add to ~/.openclaw/workspace/credentials/api-credentials.json:

json

{

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The code accesses a centralized local credentials file and extracts multiple service API keys for later use. In a skill/plugin setting, automatic credential harvesting from a shared workspace secret store is security-relevant because it expands secret access beyond explicit user intent and can facilitate unauthorized use of available tokens.

Content

Scanner excerpt · get_transcript.py (reported line 27)May include surrounding context.

python

"""Load API tokens from credentials file if not in env"""
    global YOUTUBE_API_KEY, APIFY_TOKEN
    
    creds_path = Path.home() / ".openclaw" / "workspace" / "credentials" / "api-credentials.json"
    if creds_path.exists():
        with open(creds_path) as f:
            creds = json.load(f)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill documents and relies on outbound network access to YouTube and optionally Apify, but it does not declare any explicit tool scope or allowed network permissions. That creates a transparency and policy gap: operators cannot easily constrain or review what external access the skill is expected to perform, increasing the chance of unintended or overbroad network use.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill says Apify is used for transcripts, but it does not clearly warn that requesting transcript mode sends video identifiers/URLs and related request data to a third-party service. This is a privacy and data-handling issue because users may assume all processing stays with YouTube or local tooling when in fact a separate external processor receives request data.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

When transcript fetching is enabled, the script sends user-supplied YouTube URLs and an authorization bearer token to a third-party Apify actor. This creates a real external data transmission boundary and can expose viewing targets, transcript requests, and associated token use to an external service, which is more sensitive in an agent environment where users may not expect third-party exfiltration paths.

Content

Scanner excerpt · get_transcript.py (reported line 114)May include surrounding context.

python

print(f"Error: Could not extract video ID from {url}", file=sys.stderr)
        return None
    
    api_url = f"https://api.apify.com/v2/acts/{APIFY_ACTOR}/run-sync-get-dataset-items?timeout=120"
    
    if languages:
        data = json.dumps({"videoUrls": [url], "languages": languages})

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The formatted output includes the hard-coded Turkish label "AÇIKLAMA:" while the rest of the script and CLI are in English. This imposes a locale-specific user experience without opt-in or documentation justifying the language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The usage example includes --lang tr, which suggests a specific language/locale setting, but the documentation does not explain that language is user-selectable or why Turkish is being used in examples. This can create an implicit locale preference without opt-in or justification.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The comment at L018 says the script 'reads from credentials file only', but the docstring at L024 says credentials are loaded 'if not in env', implying environment-variable support. The code itself does not read environment variables at all, so the inline documentation gives conflicting statements about how secrets are sourced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script silently reads API credentials from a fixed local path and then uses them to make external requests, which can surprise users and cause unintended secret usage or billable API consumption. In an agent-skill context, implicit credential use is riskier because the operator may not realize the skill will access local secrets automatically.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.