Back to plugin

Security audit

You.com

Security checks for vulnerabilities and agentic risk

Overview

This You.com skill pack is a disclosed MCP integration for search, research, finance, and discovery, with no hidden runtime behavior found.

Install this only if you want OpenClaw to use You.com MCP services. Expect search/research/finance prompts and requested URLs to be sent to You.com endpoints, and review any optional API-key, OAuth, or payment setup before approving it.

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (15)

MCP Config Access

High
Category
Agent Snooping
Content
---
name: "you-discover"
description: "Route You.com integration planning through the you-discover MCP tool, Docs MCP, and direct API options."
compatibility: "Requires network access. Prefer the standard You.com MCP server exposing `you-discover` and Docs MCP `searchDocs`."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-docs\":{\"url\":\"https://you.com/docs/_mcp/server\"},\"you\":{\"url\":\"https://api.you.com/mcp\"}}","author":"youdotcom-oss","version":"0.4.0","category":"discovery","keywords":"you.com,mcp,agentic-resource-discovery,ai-catalog,integration-discovery,agent-sdk"}
Confidence
80% confidence
Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Route You.com integration planning through the you-discover MCP tool, Docs MCP, and direct API options."
compatibility: "Requires network access. Prefer the standard You.com MCP server exposing `you-discover` and Docs MCP `searchDocs`."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-docs\":{\"url\":\"https://you.com/docs/_mcp/server\"},\"you\":{\"url\":\"https://api.you.com/mcp\"}}","author":"youdotcom-oss","version":"0.4.0","category":"discovery","keywords":"you.com,mcp,agentic-resource-discovery,ai-catalog,integration-discovery,agent-sdk"}
---

# You.com Discovery
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Route You.com integration planning through the you-discover MCP tool, Docs MCP, and direct API options."
compatibility: "Requires network access. Prefer the standard You.com MCP server exposing `you-discover` and Docs MCP `searchDocs`."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-docs\":{\"url\":\"https://you.com/docs/_mcp/server\"},\"you\":{\"url\":\"https://api.you.com/mcp\"}}","author":"youdotcom-oss","version":"0.4.0","category":"discovery","keywords":"you.com,mcp,agentic-resource-discovery,ai-catalog,integration-discovery,agent-sdk"}
---

# You.com Discovery
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Route You.com integration planning through the you-discover MCP tool, Docs MCP, and direct API options."
compatibility: "Requires network access. Prefer the standard You.com MCP server exposing `you-discover` and Docs MCP `searchDocs`."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-docs\":{\"url\":\"https://you.com/docs/_mcp/server\"},\"you\":{\"url\":\"https://api.you.com/mcp\"}}","author":"youdotcom-oss","version":"0.4.0","category":"discovery","keywords":"you.com,mcp,agentic-resource-discovery,ai-catalog,integration-discovery,agent-sdk"}
---

# You.com Discovery
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Answer finance questions through the You.com you-finance MCP tool, with payment-aware fallbacks for keyless hosts."
license: "MIT"
compatibility: "Requires network access and a You.com MCP host using `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-finance\":{\"url\":\"https://api.you.com/mcp/finance\"}}","author":"youdotcom-oss","version":"0.4.0","category":"finance","keywords":"you.com,mcp,finance,market-data,tickers,earnings,company-financials"}
---

# You.com Finance Research
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Answer finance questions through the You.com you-finance MCP tool, with payment-aware fallbacks for keyless hosts."
license: "MIT"
compatibility: "Requires network access and a You.com MCP host using `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-finance\":{\"url\":\"https://api.you.com/mcp/finance\"}}","author":"youdotcom-oss","version":"0.4.0","category":"finance","keywords":"you.com,mcp,finance,market-data,tickers,earnings,company-financials"}
---

# You.com Finance Research
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Answer finance questions through the You.com you-finance MCP tool, with payment-aware fallbacks for keyless hosts."
license: "MIT"
compatibility: "Requires network access and a You.com MCP host using `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-finance\":{\"url\":\"https://api.you.com/mcp/finance\"}}","author":"youdotcom-oss","version":"0.4.0","category":"finance","keywords":"you.com,mcp,finance,market-data,tickers,earnings,company-financials"}
---

# You.com Finance Research
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Use the free You.com MCP profile for unauthenticated basic web search with `you-search` only."
compatibility: "Requires network access and the You.com free MCP profile exposing `you-search`. Does not require `YDC_API_KEY` or OAuth."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-free\":{\"url\":\"https://api.you.com/mcp?profile=free\"}}","author":"youdotcom-oss","version":"0.2.0","category":"web-search","keywords":"you.com,mcp,free-search,web-search,no-auth"}
---

# You.com Free Search MCP
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Use the free You.com MCP profile for unauthenticated basic web search with `you-search` only."
compatibility: "Requires network access and the You.com free MCP profile exposing `you-search`. Does not require `YDC_API_KEY` or OAuth."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-free\":{\"url\":\"https://api.you.com/mcp?profile=free\"}}","author":"youdotcom-oss","version":"0.2.0","category":"web-search","keywords":"you.com,mcp,free-search,web-search,no-auth"}
---

# You.com Free Search MCP
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Use the free You.com MCP profile for unauthenticated basic web search with `you-search` only."
compatibility: "Requires network access and the You.com free MCP profile exposing `you-search`. Does not require `YDC_API_KEY` or OAuth."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-free\":{\"url\":\"https://api.you.com/mcp?profile=free\"}}","author":"youdotcom-oss","version":"0.2.0","category":"web-search","keywords":"you.com,mcp,free-search,web-search,no-auth"}
---

# You.com Free Search MCP
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Route research tasks between a cost-conscious agentic search workflow and the You.com you-research MCP tool for one-shot cited synthesis."
compatibility: "Requires network access and You.com MCP tools with `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-research\":{\"url\":\"https://api.you.com/mcp/research\"}}","author":"youdotcom-oss","version":"0.4.0","category":"research","keywords":"you.com,mcp,web-search,content-extraction,deep-research,citations"}
---

# You.com Research Routing
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Route research tasks between a cost-conscious agentic search workflow and the You.com you-research MCP tool for one-shot cited synthesis."
compatibility: "Requires network access and You.com MCP tools with `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-research\":{\"url\":\"https://api.you.com/mcp/research\"}}","author":"youdotcom-oss","version":"0.4.0","category":"research","keywords":"you.com,mcp,web-search,content-extraction,deep-research,citations"}
---

# You.com Research Routing
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Route research tasks between a cost-conscious agentic search workflow and the You.com you-research MCP tool for one-shot cited synthesis."
compatibility: "Requires network access and You.com MCP tools with `YDC_API_KEY`, OAuth, or MPP/x402 payment support."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-research\":{\"url\":\"https://api.you.com/mcp/research\"}}","author":"youdotcom-oss","version":"0.4.0","category":"research","keywords":"you.com,mcp,web-search,content-extraction,deep-research,citations"}
---

# You.com Research Routing
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
description: "Use You.com search and contents tools when a task needs external facts, current information, source reading, factual verification, or cited synthesis."
compatibility: "Requires network access and a You.com MCP server exposing `you-search` and `you-contents`; use `YDC_API_KEY`, OAuth, or an x402-aware client for paid/keyless retries."
license: "MIT"
metadata: {"openclaw":{"emoji":"🔍","primaryEnv":"YDC_API_KEY"},"mcp_servers":"{\"you-web\":{\"url\":\"https://api.you.com/mcp\"}}","author":"youdotcom-oss","version":"0.4.0","category":"web-search","keywords":"you.com,mcp,web-search,search,content-extraction,source-reading,citations"}
---

# Search Skill
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Autonomous Decision Making

Medium
Category
Excessive Agency
Content
1. Check whether the standard You.com MCP server exposes `you-discover` at `https://api.you.com/mcp`.
2. Check whether the You.com Docs MCP tool `searchDocs` is available at `https://you.com/docs/_mcp/server`.
3. If either server is missing, connect or install the missing MCP server(s): provide the server name, URL, and auth requirement from the `metadata.mcp_servers` field in the frontmatter above; point to the MCP setup mechanism for the current agent or MCP client; do not connect or install or modify configuration without approval.
4. Once both `you-discover` and Docs MCP are available, enter the planning loop: use `you-discover` to explore candidate resources for the target, draft a plan naming the selected resource and why it fits, then return to Docs MCP to verify auth, install, and setup steps before recommending.

## Discovery workflow
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Static analysis

No suspicious patterns detected.