Back to plugin

Security audit

You.com

Security checks for vulnerabilities and agentic risk

Overview

This You.com skill pack is a disclosed network integration for search, research, finance data, and setup guidance, with no hidden runtime behavior found.

Install only if you want your agent to use You.com MCP services. Expect search queries, URLs, and finance/research prompts to be sent to You.com; configure YDC_API_KEY, OAuth, or payment-aware clients only if you are comfortable with those external services and any spending controls they provide.

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-discover/SKILL.md (reported line 15)May include surrounding context.

md
description: "Plan how to build with You.com. Use when adding web search, content extraction, or research to an app or agent: finds the right You.com API, MCP server, SDK, or docs path (for example Vercel AI SDK, LangChain, Python SDK, or REST) through the `you-discover` tool and Docs MCP."
compatibility: "Requires network access. Uses the keyless You.com discover MCP profile exposing `you-discover` and Docs MCP `searchDocs`; no `YDC_API_KEY` or OAuth required."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-docs\":{\"url\":\"https://you.com/docs/_mcp/server\"},\"you-discover\":{\"url\":\"https://api.you.com/mcp?profile=discover\"}}","author":"youdotcom-oss","version":"0.5.0","category":"discovery","keywords":"you.com,mcp,agentic-resource-discovery,ai-catalog,integration-discovery,agent-sdk"}
---

# You.com Discovery

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-discover/SKILL.md (reported line 43)May include surrounding context.

md
description: "Plan how to build with You.com. Use when adding web search, content extraction, or research to an app or agent: finds the right You.com API, MCP server, SDK, or docs path (for example Vercel AI SDK, LangChain, Python SDK, or REST) through the `you-discover` tool and Docs MCP."
compatibility: "Requires network access. Uses the keyless You.com discover MCP profile exposing `you-discover` and Docs MCP `searchDocs`; no `YDC_API_KEY` or OAuth required."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-docs\":{\"url\":\"https://you.com/docs/_mcp/server\"},\"you-discover\":{\"url\":\"https://api.you.com/mcp?profile=discover\"}}","author":"youdotcom-oss","version":"0.5.0","category":"discovery","keywords":"you.com,mcp,agentic-resource-discovery,ai-catalog,integration-discovery,agent-sdk"}
---

# You.com Discovery

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-discover/SKILL.md (reported line 6)May include surrounding context.

md
description: "Plan how to build with You.com. Use when adding web search, content extraction, or research to an app or agent: finds the right You.com API, MCP server, SDK, or docs path (for example Vercel AI SDK, LangChain, Python SDK, or REST) through the `you-discover` tool and Docs MCP."
compatibility: "Requires network access. Uses the keyless You.com discover MCP profile exposing `you-discover` and Docs MCP `searchDocs`; no `YDC_API_KEY` or OAuth required."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-docs\":{\"url\":\"https://you.com/docs/_mcp/server\"},\"you-discover\":{\"url\":\"https://api.you.com/mcp?profile=discover\"}}","author":"youdotcom-oss","version":"0.5.0","category":"discovery","keywords":"you.com,mcp,agentic-resource-discovery,ai-catalog,integration-discovery,agent-sdk"}
---

# You.com Discovery

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-finance/references/coinbase-payments-mcp.md (reported line 8)May include surrounding context.

md
description: "Answer finance and market-data questions with the You.com `you-finance` MCP tool: stock prices, tickers, earnings, company financials, and market trends, with payment-aware fallbacks for keyless hosts."
license: "MIT"
compatibility: "Requires network access and a You.com MCP host using `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-finance\":{\"url\":\"https://api.you.com/mcp/finance\"}}","author":"youdotcom-oss","version":"0.5.1","category":"finance","keywords":"you.com,mcp,finance,market-data,tickers,earnings,company-financials"}
---

# You.com Finance Research

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-finance/SKILL.md (reported line 17)May include surrounding context.

md
description: "Answer finance and market-data questions with the You.com `you-finance` MCP tool: stock prices, tickers, earnings, company financials, and market trends, with payment-aware fallbacks for keyless hosts."
license: "MIT"
compatibility: "Requires network access and a You.com MCP host using `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-finance\":{\"url\":\"https://api.you.com/mcp/finance\"}}","author":"youdotcom-oss","version":"0.5.1","category":"finance","keywords":"you.com,mcp,finance,market-data,tickers,earnings,company-financials"}
---

# You.com Finance Research

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-finance/SKILL.md (reported line 6)May include surrounding context.

md
description: "Answer finance and market-data questions with the You.com `you-finance` MCP tool: stock prices, tickers, earnings, company financials, and market trends, with payment-aware fallbacks for keyless hosts."
license: "MIT"
compatibility: "Requires network access and a You.com MCP host using `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-finance\":{\"url\":\"https://api.you.com/mcp/finance\"}}","author":"youdotcom-oss","version":"0.5.1","category":"finance","keywords":"you.com,mcp,finance,market-data,tickers,earnings,company-financials"}
---

# You.com Finance Research

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-research/references/coinbase-payments-mcp.md (reported line 8)May include surrounding context.

md
description: "Multi-source research with citations using You.com. Use for questions that need several sources compared and synthesized, such as library or framework comparisons, tool and vendor evaluations, market research, or deep-dive reports. Routes between a cost-conscious agentic search loop and the one-shot `you-research` MCP tool."
compatibility: "Requires network access and You.com MCP tools with `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-research\":{\"url\":\"https://api.you.com/mcp/research\"}}","author":"youdotcom-oss","version":"0.5.1","category":"research","keywords":"you.com,mcp,web-search,content-extraction,deep-research,citations"}
---

# You.com Research Routing

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-research/SKILL.md (reported line 17)May include surrounding context.

md
description: "Multi-source research with citations using You.com. Use for questions that need several sources compared and synthesized, such as library or framework comparisons, tool and vendor evaluations, market research, or deep-dive reports. Routes between a cost-conscious agentic search loop and the one-shot `you-research` MCP tool."
compatibility: "Requires network access and You.com MCP tools with `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-research\":{\"url\":\"https://api.you.com/mcp/research\"}}","author":"youdotcom-oss","version":"0.5.1","category":"research","keywords":"you.com,mcp,web-search,content-extraction,deep-research,citations"}
---

# You.com Research Routing

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-research/SKILL.md (reported line 6)May include surrounding context.

md
description: "Multi-source research with citations using You.com. Use for questions that need several sources compared and synthesized, such as library or framework comparisons, tool and vendor evaluations, market research, or deep-dive reports. Routes between a cost-conscious agentic search loop and the one-shot `you-research` MCP tool."
compatibility: "Requires network access and You.com MCP tools with `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-research\":{\"url\":\"https://api.you.com/mcp/research\"}}","author":"youdotcom-oss","version":"0.5.1","category":"research","keywords":"you.com,mcp,web-search,content-extraction,deep-research,citations"}
---

# You.com Research Routing

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-web/references/free-profile.md (reported line 10)May include surrounding context.

md
description: "Search the live web and read full pages with You.com. Use whenever a task needs information newer than training data or from outside the codebase: current library docs and API references, changelogs and release notes, breaking changes, error messages, package versions, pricing, news, or any claim to verify with cited sources. Works keyless through the free MCP profile when no You.com credentials are configured."
compatibility: "Requires network access and a You.com MCP server exposing `you-search` and `you-contents`; use `YDC_API_KEY`, OAuth, or an x402-aware client for paid/keyless retries. With no credentials, the free MCP profile (`profile=free`) provides keyless `you-search` only — see `references/free-profile.md`."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-web\":{\"url\":\"https://api.you.com/mcp\"}}","author":"youdotcom-oss","version":"0.5.0","category":"web-search","keywords":"you.com,mcp,web-search,search,content-extraction,source-reading,citations"}
---

# Search Skill

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · skills/you-web/SKILL.md (reported line 6)May include surrounding context.

md
description: "Search the live web and read full pages with You.com. Use whenever a task needs information newer than training data or from outside the codebase: current library docs and API references, changelogs and release notes, breaking changes, error messages, package versions, pricing, news, or any claim to verify with cited sources. Works keyless through the free MCP profile when no You.com credentials are configured."
compatibility: "Requires network access and a You.com MCP server exposing `you-search` and `you-contents`; use `YDC_API_KEY`, OAuth, or an x402-aware client for paid/keyless retries. With no credentials, the free MCP profile (`profile=free`) provides keyless `you-search` only — see `references/free-profile.md`."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-web\":{\"url\":\"https://api.you.com/mcp\"}}","author":"youdotcom-oss","version":"0.5.0","category":"web-search","keywords":"you.com,mcp,web-search,search,content-extraction,source-reading,citations"}
---

# Search Skill

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · skills/you-discover/SKILL.md (reported line 17)May include surrounding context.

md
1. Check whether the keyless You.com discover MCP profile exposes `you-discover` at `https://api.you.com/mcp?profile=discover` (no `YDC_API_KEY` or OAuth required).
2. Check whether the You.com Docs MCP tool `searchDocs` is available at `https://you.com/docs/_mcp/server`.
3. If either server is missing, connect or install the missing MCP server(s): provide the server name, URL, and auth requirement from the `metadata.mcp_servers` field in the frontmatter above; point to the MCP setup mechanism for the current agent or MCP client; do not connect or install or modify configuration without approval.
4. Once both `you-discover` and Docs MCP are available, enter the planning loop: use `you-discover` to explore candidate resources for the target, draft a plan naming the selected resource and why it fits, then return to Docs MCP to verify auth, install, and setup steps before recommending.

## Discovery workflow

Static analysis

No suspicious patterns detected.