OpenClaw YouTube Publisher

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:37 PM UTC
• Version:
  1.1.5

Overview

This skill is a disclosed YouTube publishing workflow helper that creates local run records and reports, with no evidence of hidden credential access or unrelated behavior.

Install only if you are comfortable using it with a logged-in YouTube browser profile. Keep final publishing user-approved, review generated reports and screenshots before sharing, and avoid putting cookies, tokens, private paths, or sensitive account details into manifests or notes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Credential Access

High

• Category: Privilege Escalation

Content

### Safety rules

- Do not store cookies, secrets, or access tokens in notes or artifacts.
- Do not use private absolute filesystem paths in the final bundle.
- Treat moderation delays and post-processing lag as publish outcomes to record, not as silent success.

• Confidence: 70% confidence
• Finding: access tokens

VirusTotal

66/66 vendors flagged this skill as clean.