OpenClaw YouTube Publisher

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:54 AM UTC
• Version: 1.1.5

Overview

The skill is a coherent YouTube publishing and reporting helper, with disclosed local scripts and user-controlled publishing steps, but generated reports should be reviewed before sharing.

Use this only with a YouTube browser profile you intentionally want OpenClaw to use, keep runs in dry_run until you approve publishing, and inspect the generated markdown before sharing it. Do not put cookies, tokens, private URLs, or sensitive local paths into manifests or step notes; if any credential appears in a generated report, revoke it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/render_youtube_creator_report.py:69

Finding

Manifest-Controlled Markdown and HTML Injection in Generated Reports

Content

View full analysis

str: text = str(value or "").strip() if not text: return "n/a" text = redact_secret_like_text(text) return URL_PATTERN.sub(lambda match: safe_public_url(match.group(0)), text) ``` Several manifest fields are then inserted directly into Markdown, including fields that do not pass through `sanitize_text()`: ```python lines = [ "# OpenClaw YouTube Publish Report", "", f"- Run: `{run.get('run_id', '')}`", f"- Channel: {sanitize_text(run.get('channel', ''))}", f"- Goal: {sanitize_text(run.get('goal', ''))}", f"- Browser profile: {safe_browser_profile(run.get('browser_profile', ''))}", f"- Kind: {run.get('kind', '')}", f"- Stage: {run.get('stage', '')}", f"- Visibility: {run.get('visibility', '')}", f"- Audience: {run.get('audience', '')}", f"- Studio URL: {safe_public_url(run.get('target_url', ''))}", f"- Video file: {safe_display_path(assets.get('video_file', ''))}", f"- Title: {sanitize_text(assets.get('title', ''))}", ``` ```python for index, step in enumerate(steps, start=1): lines.append(f"### {index}. {step.get('step_id', f'step-{index}')}") lines.append(f"- Surface: {sanitize_text(step.get('surface', ''))}") lines.append(f"- Status: **{step.get('status', 'unknown')}**") ``` ### Technical Analysis The report renderer treats manifest content as trusted Markdown. The `sanitize_text()` function only redacts selected secret-like strings and replaces HTTP or HTTPS URLs according to an allowlist. It does not escape Markdown metacharacters or neutralize raw HTML. Moreover, fields such as `run_id`, `kind`, `stage`, `visibility`, `audience`, `step_id`, and `status` bypass `sanitize_text() ...[truncated 2420 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/check_youtube_creator_bundle.py:15

Finding

Bearer Tokens Are Not Detected or Redacted Due to an Incorrect Regular Expression

Content

View full analysis

str: output = value for pattern in SECRET_PATTERNS: output = pattern.sub("[redacted-secret-like-value]", output) return output ``` ### Technical Analysis The bearer-token expression is declared as a raw string but contains `\\s+`: ```python r"Bearer\\s+[A-Za-z0-9._-]{10,}" ``` In this context, `\\s` in the regular expression matches a literal backslash followed by the letter `s`; it does not match whitespace. A normal authorization value such as `Bearer eyJhbGciOi...` therefore does not match. This defect affects both security controls: - `check_youtube_creator_bundle.py` may fail to produce a secret-related error. - `render_youtube_creator_report.py` may leave the bearer t ...[truncated 2057 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill is a YouTube publisher used to publish Shorts via a logged-in browser profile. The supplied code does not perform publishing, browser automation, login/profile use, or YouTube Studio interactions. Instead, it validates a manifest/run bundle before sharing: it checks required metadata, step structure, file paths, asset/artifact existence, and detects secret-like strings and private URLs, then writes a JSON report. This is a materially different primary purpose from publishing, so the description does not accurately represent the code chunk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.

md

### Safety rules

- Do not store cookies, secrets, or access tokens in notes or artifacts.
- Do not use private absolute filesystem paths in the final bundle.
- Treat moderation delays and post-processing lag as publish outcomes to record, not as silent success.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill invokes local Python scripts that read and write files and may process URLs, but the manifest declares no explicit tool scope or permissions boundary. In an agent ecosystem, that mismatch can cause over-broad execution authority, reduce reviewer visibility into what the skill can do, and increase the chance of unintended file or network access during use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.