ClawHub
Back to skill

Security audit

YouTube Transcript

Security checks across malware telemetry and agentic risk

Overview

The skill is purpose-aligned for fetching YouTube transcripts, but it can automatically change the host's VPN and routing settings during normal use.

Install only if you intentionally want this skill to use a WireGuard/residential route and are comfortable with it changing local VPN and routing state. Prefer running it in an isolated environment with a dedicated, tightly scoped WireGuard configuration, and assume video IDs may be sent to YouTube-related services and noembed.com.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
def bring_up_vpn():
    """Attempt to bring up VPN."""
    try:
        subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)
        subprocess.run(
            ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"],
            capture_output=True, timeout=5
Confidence
92% confidence
Finding
subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
"""Attempt to bring up VPN."""
    try:
        subprocess.run(["wg-quick", "up", VPN_INTERFACE], capture_output=True, timeout=10)
        subprocess.run(
            ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"],
            capture_output=True, timeout=5
        )
Confidence
94% confidence
Finding
subprocess.run( ["ip", "rule", "add", "from", VPN_SOURCE_IP, "table", "51820"], capture_output=True, timeout=5 )

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill advertises transcript fetching but the documentation indicates it uses shell execution and network access without declaring those capabilities. Undeclared network and shell behavior reduces transparency and can lead to unexpected command execution or outbound connections in environments that rely on permission metadata for policy enforcement.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The skill manipulates VPN and routing configuration on the host in order to fetch YouTube transcripts, which is significantly broader access than the user-facing functionality implies. In an agent skill context, this expands the blast radius from simple web retrieval to privileged network administration.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The workflow states that the script checks VPN status and brings it up automatically, but the skill description does not clearly warn users that it may alter network routing or enable proxy/VPN connectivity. Automatically changing network state can surprise users, bypass expected egress controls, and create compliance or privacy risks, especially because the skill explicitly mentions residential IP proxy use to evade YouTube cloud IP blocks.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The setup guide instructs the user to re-route traffic through a residential/home IP using WireGuard, including default-route style configuration (`AllowedIPs = 0.0.0.0/0`) and NAT/masquerading, but it does not provide explicit safety, privacy, or network-impact warnings. This can expose a home network to unintended traffic routing, attribution, logging, abuse complaints, and misconfiguration risk, especially because the stated goal is to bypass YouTube cloud-IP blocking.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill silently brings up a WireGuard interface and changes routing without any user or administrator confirmation. In this context, the lack of disclosure and consent makes the behavior risky because a seemingly simple transcript request can trigger privileged network reconfiguration.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.