ClawHub
Back to skill

Security audit

yt2gdrive

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed YouTube-to-Google-Drive sync helper with expected local staging, upload, cleanup, and optional scheduling behavior.

Before installing, configure rclone intentionally, review the channel list, run --dry-run first, and keep LOCAL_DIR pointed at a dedicated staging folder so unrelated local files are not uploaded or cleaned. Only run scripts/install_launchd.sh if you want the sync to run automatically every day, and use the documented launchctl unload command to disable it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill advertises and documents shell-based operational behavior (`yt-dlp`, `rclone`, `ffmpeg`, and script execution) but does not declare corresponding permissions. This creates a transparency and trust problem: users or hosting systems may underestimate that the skill can execute local commands, access local files, and transfer data externally.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The description emphasizes syncing media but does not prominently warn that the workflow uploads files to Google Drive and automatically cleans local files. Users could run the skill without fully understanding that it causes outbound data transfer and deletion of local staged content, which can lead to privacy, retention, and data-loss concerns.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The script creates a LaunchAgent plist and immediately loads it, establishing persistence without any interactive confirmation or dry-run step. While this matches the stated purpose of installing a scheduled task, silently making a persistent change can surprise users and increases the risk of unintended background execution if the script is run casually or by another installer.

Session Persistence

Medium
Category
Rogue Agent
Content
chmod 644 "$PLIST"
launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"
echo "✅ launchd 任务已安装：每天 ${HOUR}:${MINUTE} 运行 $SCRIPT"
echo "   卸载: launchctl unload $PLIST"
Confidence
97% confidence
Finding
`launchctl load "$PLIST"` activates a user LaunchAgent, causing the referenced script to run automatically on a schedule and establishing ongoing persistence in the user session. In this skill's context, scheduled syncing is expected behavior, but it still creates an autostart mechanism that could be abused if the underlying script or its path is later modified.

Session Persistence

Medium
Category
Rogue Agent
Content
chmod 644 "$PLIST"
launchctl unload "$PLIST" 2>/dev/null || true
launchctl load "$PLIST"
echo "✅ launchd 任务已安装：每天 ${HOUR}:${MINUTE} 运行 $SCRIPT"
echo "   卸载: launchctl unload $PLIST"
Confidence
97% confidence
Finding
`launchctl load "$PLIST"` activates a user LaunchAgent, causing the referenced script to run automatically on a schedule and establishing ongoing persistence in the user session. In this skill's context, scheduled syncing is expected behavior, but it still creates an autostart mechanism that could be abused if the underlying script or its path is later modified.

Static analysis

No suspicious patterns detected.