ClawHub
Back to skill

Security audit

Youtube Transcript Api

Security checks across malware telemetry and agentic risk

Overview

This skill appears to do what it says, but users should understand that transcript data may be sent to an external API and optionally to a webhook they choose.

Install only if you are comfortable sending YouTube video identifiers and transcript content to YouTubeTranscript.dev. Use webhook_url only with a trusted HTTPS endpoint under your control, and avoid submitting confidential, regulated, or private video content unless your data-handling requirements allow it.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill documentation instructs users to send YouTube URLs/IDs and receive transcript data via a third-party API, but it does not clearly warn that this content leaves the local environment and is transmitted to an external service. This can cause privacy, compliance, or data-handling issues if users submit sensitive or regulated video references or transcript content without informed consent.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The ASR workflow documents use of a user-specified webhook URL for result delivery but does not warn that transcripts may be posted to an external endpoint, potentially exposing sensitive text to unintended recipients. If users provide an untrusted, mistyped, or publicly accessible webhook, transcription results could be leaked or intercepted.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.