ClawHub
Back to skill

Security audit

Youtube Instant Article

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says broadly, but it can automatically publish YouTube-derived content and images to third-party services while loading broad local credential files.

Review before installing. Use this only if you want YouTube summaries turned into public or externally hosted Telegraph articles. Do not point it at private, unlisted, sensitive, or embargoed videos unless you accept that frames and generated text may leave your machine. Avoid the wrapper and fixed .env sourcing; provide only the needed TELEGRAPH_TOKEN and OPENAI_API_KEY through a scoped environment or secret manager, and treat debug mode as retaining local extracted media.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
instant-article.sh:6
Finding

Arbitrary Shell Execution Through Sourced Credential Files

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/generate.sh:15
Finding

Predictable Temporary Directory Used for Untrusted File Operations

Content
View full analysis
/dev/null || true; } trap cleanup EXIT mkdir -p "$SLIDES_DIR" ``` ### Technical Analysis The temporary directory name is derived only from the process ID. Process IDs are observable or predictable on many systems, and `mkdir -p` does not provide exclusive, atomic creation. The script does not verify that the resulting path is a newly created directory owned by the current user. The path is passed to the external `summarize` process as an output directory, searched recursively with `find`, and later recursively removed with `rm -rf`. If another local user or process prepares the path before creation, the generator may operate on attacker-controlled filesystem objects. The exact consequences depend on platform filesystem semantics and the behavior of the external `summarize` utility. The code does not itself demonstrate that `rm -rf` follows a directory symlink, so deletion outside the selected path is not asserted. The confirmed issue is that the temporary workspace is predictable and not securely created. ### Attack Path 1. A local attacker observes or predicts the generator process ID. 2. Before `mkdir -p` executes, the attacker creates `/tmp/yt-instant-slides-` or redirects it to an attacker-controlled location. 3. `mkdir -p` accepts the existing path instead of proving exclusive ownership. 4. The Skill directs extracted frames into that location and reads image files discovered beneath it. 5. The attacker may access generated frames, interfere with output, or place attacker-selected image files into the publishing pipeline. 6. Cleanup operates on the attacker-prepared path when debug mode is disabled. This attack req ...[truncated 565 chars]
Remediation
View remediation
&2; exit 1; } ``` 2. Install the cleanup trap only after `mktemp` succeeds. 3. Before cleanup, verify that the path is a directory owned by the current user and matches the expected temporary-directory prefix. 4. Do not use `mkdir -p` for security-sensitive temporary workspace creation. 5. Keep the restrictive `umask 077` while creating frames so they are not readable by other users. 6. Consider validating discovered files as regular, non-symbolic-link image files before uploading them. ]]>

T09 · Insecure Skill Coding Practices

Note
Location
scripts/generate.sh:38
Finding

Debug Mode Retains Extracted Video Frames in Shared Temporary Storage

Content
View full analysis
/dev/null || true; } trap cleanup EXIT mkdir -p "$SLIDES_DIR" ``` ### Technical Analysis When the user supplies `--debug`, `DEBUG` becomes `true` and the cleanup function deliberately leaves all extracted frames under `/tmp/yt-instant-slides-`. The script does not explicitly set restrictive directory permissions, warn that potentially sensitive media will be retained, print the retained path, or provide a deletion procedure. Although retention is intentional for debugging, placing retained content in a predictable shared temporary namespace without explicit access controls creates unnecessary exposure. ### Attack Path 1. A user runs the generator with `--debug`. 2. The external `summarize` utility writes extracted video frames into the temporary directory. 3. The process exits, but cleanup is skipped because debug mode is enabled. 4. The frames remain on disk until manually removed or cleared by the operating system. 5. Another local process or user may discover and read them if filesystem permissions permit. ### Impact Assessment The issue may disclose screenshots or frames from the processed video and reveal what content the user processed. Exposure is limited to retained local files and depends on host permissions. No additional system privileges are obtained through this behavior alone, but persistent temporary data increases privacy risk and forensic residue. ]]>
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
Findings (28)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 56)May include surrounding context.

bash
   ./scripts/setup.sh

This creates a Telegraph account and outputs your access token.

  1. Set environment variables:
    bash

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 136)May include surrounding context.

bash
   ./scripts/setup.sh

This creates a Telegraph account and outputs your access token.

  1. Set environment variables:
    bash

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The manifest frames the skill as a YouTube summarization/formatting helper, but the instructions reveal stronger side effects: uploading extracted images to catbox.moe, publishing content to Telegraph, and invoking an external summarize pipeline. That mismatch is dangerous because users may provide a URL expecting local summarization while the skill actually redistributes derived content and sends data to multiple third parties without clear consent or disclosure.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The manifest frames the skill as a YouTube summarization/formatting helper, but the instructions reveal stronger side effects: uploading extracted images to catbox.moe, publishing content to Telegraph, and invoking an external summarize pipeline. That mismatch is dangerous because users may provide a URL expecting local summarization while the skill actually redistributes derived content and sends data to multiple third parties without clear consent or disclosure.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
96% confidence
Finding

The explicit instruction to source /Users/viticci/clawd/.env grants the skill access to whatever secrets are stored in that file, not just the minimum needed for the task. In an agent-execution environment, this creates an unnecessary credential exposure path and could enable abuse of unrelated tokens if the script or downstream tools are compromised or over-permissive.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

Quick Start

bash
source /Users/viticci/clawd/.env && {baseDir}/scripts/generate.sh "$ARGUMENTS"

Options

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

Referencing access tokens is not inherently malicious, but declaring reliance on a Telegraph access token confirms the skill performs authenticated external actions beyond simple summarization. That increases risk because the token can be used to publish content or act on behalf of the operator if mishandled, logged, or exposed through debugging or subprocess behavior.

Content

Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.

md
## Environment Variables

Required environment variables are loaded from `/Users/viticci/clawd/.env`:
- `TELEGRAPH_TOKEN` - Telegraph API access token
- `OPENAI_API_KEY` - For GPT-5.2 summarization

## Output

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · instant-article.sh (reported line 2)May include surrounding context.

sh
#!/bin/bash
# Wrapper script - sources .env and runs generate.sh
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

# Source .env if it exists

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · instant-article.sh (reported line 5)May include surrounding context.

sh
#!/bin/bash
# Wrapper script - sources .env and runs generate.sh
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

# Source .env if it exists

Credential Access

High
Category
Privilege Escalation
Confidence
94% confidence
Finding

source "$SCRIPT_DIR/.env" executes the contents of .env as shell code in the current process, which can expose credentials, alter execution flow, or run arbitrary commands if the file is malicious or unexpectedly modified. Because this skill only needs to transform YouTube content, loading executable configuration from disk is unnecessary and makes the wrapper materially more dangerous.

Content

Scanner excerpt · instant-article.sh (reported line 6)May include surrounding context.

sh
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"

# Source .env if it exists
[[ -f "$SCRIPT_DIR/.env" ]] && source "$SCRIPT_DIR/.env"
[[ -f "$HOME/clawd/.env" ]] && source "$HOME/clawd/.env"

exec "$SCRIPT_DIR/scripts/generate.sh" "$@"

Credential Access

High
Category
Privilege Escalation
Confidence
97% confidence
Finding

source "$HOME/clawd/.env" is especially risky because it imports and executes a broad user-scoped shared environment file outside the skill directory, increasing the chance of privilege boundary crossing, secret leakage, or arbitrary code execution from unrelated configuration. In the context of a content-processing skill, this behavior is not aligned with the stated purpose and significantly increases the attack surface.

Content

Scanner excerpt · instant-article.sh (reported line 7)May include surrounding context.

sh
# Source .env if it exists
[[ -f "$SCRIPT_DIR/.env" ]] && source "$SCRIPT_DIR/.env"
[[ -f "$HOME/clawd/.env" ]] && source "$HOME/clawd/.env"

exec "$SCRIPT_DIR/scripts/generate.sh" "$@"

Lp1

High
Category
MCP Least Privilege
Confidence
75% confidence
Finding

The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Content

No source excerpt is available for this finding.

Chaining Abuse

High
Category
Tool Misuse
Confidence
75% confidence
Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/generate.sh (reported line 36)May include surrounding context.

sh
[[ -z "$URL" ]] && { echo "Usage: $0 <youtube_url> [--slides-max N]"; exit 1; }

# Cleanup
cleanup() { [[ "$DEBUG" == "false" ]] && rm -rf "$SLIDES_DIR" 2>/dev/null || true; }
trap cleanup EXIT
mkdir -p "$SLIDES_DIR"

Credential Access

High
Category
Privilege Escalation
Confidence
83% confidence
Finding

The script prints a live Telegraph access token directly to stdout and instructs the user to store it in shell profiles or a project .env file. While this is not active credential theft, exposing tokens in terminal history, logs, shared shells, or repository-adjacent .env files increases the chance of credential leakage and unauthorized article/account access.

Content

Scanner excerpt · scripts/setup.sh (reported line 66)May include surrounding context.

sh
echo ""
    echo "  export TELEGRAPH_TOKEN=\"$TOKEN\""
    echo ""
    echo "Or create a .env file in your project:"
    echo ""
    echo "  echo 'TELEGRAPH_TOKEN=$TOKEN' >> .env"
    echo ""

Credential Access

High
Category
Privilege Escalation
Confidence
86% confidence
Finding

The instruction to append TELEGRAPH_TOKEN to a .env file encourages storing a credential in a commonly committed or shared project file. In the context of an install/setup script for a content-processing skill, this raises the risk of accidental disclosure through version control, backups, CI logs, or team sharing.

Content

Scanner excerpt · scripts/setup.sh (reported line 68)May include surrounding context.

sh
echo ""
    echo "Or create a .env file in your project:"
    echo ""
    echo "  echo 'TELEGRAPH_TOKEN=$TOKEN' >> .env"
    echo ""
    echo "To manage your articles, visit:"
    echo "  $AUTH_URL"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly states that extracted slides are uploaded to catbox.moe and published via Telegraph, but it does not clearly warn users that video-derived content and metadata will be sent to third-party services. In a skill intended to process user-supplied YouTube URLs by default, this can cause unintended external sharing of user-requested content and generated artifacts, creating privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 66)May include surrounding context.

  1. Configure summarize (optional):
    bash
    mkdir -p ~/.summarize
echo '{"model": "openai/gpt-5.2"}' > ~/.summarize/config.json

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 142)May include surrounding context.

Summarize Config

Create ~/.summarize/config.json:

json
{
  "model": "openai/gpt-5.2"

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick-start command sources a fixed local .env file before running the script, exposing the skill to local secret material unrelated to the immediate user request. In an agent context, instructing execution with sourced credentials broadens the trust boundary and can enable unintended use of API keys or tokens during processing and publication.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill describes outputs and architecture but does not warn that summaries and extracted slide images are uploaded to Telegraph and catbox.moe. In this context, the omission is meaningful because the skill is marked as the default handler for YouTube links, increasing the chance that users trigger external publication without understanding the data flow.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

Extracted video slides are uploaded to catbox.moe, a third-party file host, without any visible consent gate or disclosure in the script flow. This can expose user-requested content, potentially including private/unlisted video material or generated frames, to an external service outside the primary publication target.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.sh (reported line 174)May include surrounding context.

sh
echo "🌐 Publishing..." >&2

RESPONSE=$(curl -s -X POST "https://api.telegra.ph/createPage" \
    -H "Content-Type: application/json" \
    -d "$(jq -n \
        --arg t "$TELEGRAPH_TOKEN" \

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The script sends the TELEGRAPH_TOKEN in a POST request to api.telegra.ph to create a page. Although the script checks for the environment variable and logs that publishing is occurring, it does not clearly disclose to the user that their access token is being transmitted to a remote service as part of publication.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/generate.sh (reported line 174)May include surrounding context.

sh
echo "Creating Telegraph account..."

# Create Telegraph account
RESPONSE=$(curl -s "https://api.telegra.ph/createAccount" \
    -d "short_name=$SHORT_NAME" \
    -d "author_name=$AUTHOR_NAME")

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.sh (reported line 44)May include surrounding context.

sh
echo "Creating Telegraph account..."

# Create Telegraph account
RESPONSE=$(curl -s "https://api.telegra.ph/createAccount" \
    -d "short_name=$SHORT_NAME" \
    -d "author_name=$AUTHOR_NAME")

External Transmission

Medium
Category
Data Exfiltration
Confidence
70% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/setup.sh (reported line 44)May include surrounding context.

sh
echo "Creating Telegraph account..."

# Create Telegraph account
RESPONSE=$(curl -s "https://api.telegra.ph/createAccount" \
    -d "short_name=$SHORT_NAME" \
    -d "author_name=$AUTHOR_NAME")

Static analysis

No suspicious patterns detected.