Skills/ClawHub/youtube-s3-uploader

youtube-s3-uploader@3.0.5

CAUTION· static only

Publisher claims: "Download videos from YouTube, Twitter/X, TikTok, Douyin, Bilibili and upload to S3-compatible storage. Universal video downloader with smart quality selectio..." Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher aiastia · publishing for 220 daysInstalls 1,081Last detonated 1 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-15 and scored it 67/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
File type combined with upload actionindex.js:41 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🎬 YouTube to S3 Uploader');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionindex.js:54 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' youtube-s3-upload - Download YouTube videos');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixed-upload-video-to-s3.js:312 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' --simple 强制使用简单PUT方法');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixed-upload-video-to-s3.js:309 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' node fixed-upload-video-to-s3.js <视频文件路径> [S3路径]');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/video-to-s3-universal.js:292 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('上传者:', videoInfo.uploader || videoInfo.uploader_id || '未知');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/youtube-to-s3.js:426 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🎬 YouTube to S3 Uploader - Unified Version');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionindex.js:47 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🌐 Universal Video to S3 Uploader');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/youtube-to-s3.js:22 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🎬 YouTube to S3 Uploader - Unified Version');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixed-upload-video-to-s3.js:78 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('选择方法:', method === 'multipart' ? '分块上传' : '简单PUT');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/video-to-s3-universal.js:36 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🌐 Universal Video to S3 Uploader');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/video-to-s3-universal.js:547 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('上传耗时:', uploadResult.uploadTime.toFixed(2), '秒');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionindex.js:65 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🎬 YouTube to S3 Uploader');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/youtube-to-s3.js:465 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('上传速度:', (uploadResult.size / 1024 / 1024 / uploadResult.uploadTime).toFixed(2), 'MB/秒');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/youtube-to-s3.js:464 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('上传耗时:', uploadResult.uploadTime.toFixed(2), '秒');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/cli.js:48 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` Average Speed: ${(result.size / 1024 / 1024 / result.uploadTime).toFixed(2)} MB/s\n`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixed-upload-video-to-s3.js:113 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('上传ID:', uploadId.substring(0, 50) + '...');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/video-to-s3-universal.js:491 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🌐 Universal Video to S3 Uploader');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/video-to-s3-universal.js:548 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('上传速度:', (uploadResult.size / 1024 / 1024 / uploadResult.uploadTime).toFixed(2), 'MB/秒');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/cli.js:47 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(` Upload Time: ${result.uploadTime.toFixed(2)} seconds`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/youtube-to-s3.js:232 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('上传者:', videoInfo.uploader || '未知');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixed-upload-video-to-s3.js:224 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('\n🔧 使用简单PUT上传（小文件）...');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionindex.js:55 · File type combined with upload action — agent may exfiltrate local data filesconsole.log(' video-s3-upload - Download videos from any platform');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionsrc/cli.js:25 · File type combined with upload action — agent may exfiltrate local data filesconsole.log('🎬 YouTube to S3 Uploader\n');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07

Cost to the agent

Instructions loaded
≈2,314 tok
1 file · 17 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

13 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim aiastia: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim aiastiaPropose a patch to the maintainer