ClawHub
Back to skill

Security audit

tl;dw - YouTube Video Summarizer

Security checks across malware telemetry and agentic risk

Overview

This appears to be a legitimate YouTube transcript summarizer, but it needs review because it can use browser login cookies while weakening HTTPS certificate checks and storing transcript data locally.

Review before installing. Use public videos when possible. If you use cookies, treat the cookie file like a password: keep it out of shared or synced folders, restrict access, never commit or share it, and delete it after use. Prefer a version that removes nocheckcertificate and documents how to clear cached transcripts and metadata.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (2)

Missing User Warnings

Low
Confidence
88% confidence
Finding
The skill explicitly advertises local caching, but it does not clearly warn users that transcripts and associated video metadata will persist on disk after use. This can expose potentially sensitive viewing history, transcript content, or metadata to other local users or later processes, especially on shared systems.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill instructs users to export and supply browser cookies to access restricted content without warning that cookies are authenticated session credentials. Mishandling that file could allow account takeover or unauthorized access to the user's YouTube/Google session if the cookie file is exposed, reused, or retained insecurely.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.