YouTube-Hook

Generate high-performing YouTube video scripts, titles, thumbnails, descriptions, and chapter markers from any topic or content

This skill appears internally consistent, but before installing consider: (1) it will send your query text to Tavily when using trend analysis — only provide non-sensitive topics and review Tavily's privacy policy; (2) use a dedicated, limited-scope TAVILY_API_KEY (rotate if compromised); (3) if you need stronger isolation, run the skill in an environment with network egress controls or monitor outbound calls to api.tavily.com; (4) the bundled Python scripts are small and readable—review them yourself if you have concerns. Overall the requested access is minimal and expected for the described functionality.

Type: OpenClaw Skill Name: youtube-hook Version: 1.0.0 The skill is classified as suspicious due to a lack of input sanitization in its Python scripts. Specifically, `scripts/trend_analyzer.py` uses unsanitized user input (`topic`) directly in a query to the external Tavily API (https://api.tavily.com/). This creates a prompt injection vulnerability against the third-party API, which could lead to API abuse or unintended search results. Similar input sanitization issues exist in `scripts/hook_generator.py` and `scripts/title_optimizer.py`, where unsanitized user input is used in string formatting, posing a risk if their output were subsequently executed in a shell context. There is no evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints, backdoor installation, or direct system compromise.