ClawHub
Back to skill

Security audit

Felo YouTube Subtitling

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it fetches YouTube subtitles through Felo's API using a Felo API key.

Install if you trust Felo with the YouTube video IDs or URLs you ask it to process and with your Felo API key. Prefer the bundled script, verify the optional felo-ai npm package before installing it globally, and avoid setting FELO_API_BASE to an untrusted server.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Low
Confidence
91% confidence
Finding
The skill sends the user-supplied YouTube video URL/ID, language selection, and related options to Felo's external API, but the documentation does not clearly warn users about this data transfer. While the transmitted data is not inherently highly sensitive in most cases, omission of this disclosure can cause unintended sharing of user activity or private/internal video identifiers with a third party.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.env_credential_access

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
scripts/run_youtube_subtitling.mjs:172