YouTube Upload Videos Skill

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:05 AM UTC
• Version: 1.0.0

Overview

This skill appears to upload YouTube videos as advertised, but it stores a reusable account token unsafely and can later upload without re-consent.

Review before installing. Use this only in a private, trusted directory, avoid shared working folders, do not commit client_secret.json or token.pickle, delete or revoke the token when finished, and prefer a version that stores OAuth credentials in a non-executable format with restricted file permissions and explicit per-upload confirmation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/upload.py:15

Finding

Arbitrary Code Execution Through Unsafe OAuth Token Deserialization

Content

View full analysis

Vulnerability Details

File Location: scripts/upload.py, lines 15-17
Vulnerability Type: Unsafe deserialization
Risk Level: High

Vulnerable Code:

python

if os.path.exists(token_file):
    with open(token_file, 'rb') as token:
        creds = pickle.load(token)

Technical Analysis

The application deserializes the predictable relative file token.pickle using Python's pickle.load(). Pickle is an executable serialization format: specially constructed objects can invoke attacker-selected Python callables during deserialization.

The script does not verify the token file's ownership, permissions, integrity, type, or resolved location before loading it. Because token_file is set to a relative path, the file is selected from the process's current working directory rather than a fixed, private credential directory.

Attack Path

1. An attacker obtains write access to the directory from which the skill will be executed, or otherwise causes the process to start in an attacker-controlled directory.
2. The attacker creates a malicious token.pickle containing a pickle reduction payload that invokes an attacker-selected callable.
3. A user or agent invokes scripts/upload.py from that directory.
4. os.path.exists(token_file) detects the malicious file.
5. pickle.load(token) executes the embedded payload before OAuth validation or video upload occurs.

Impact Assessment

Successful exploitation provides arbitrary Python code execution with the operating-system privileges of the process running the skill. The attacker could read or modify files accessible to that account, steal environment variables and credentials, alter uploaded content, make network requests, or execute additional local processes. The precise scope is bounded by the host account's permissions and any applicable sandbox controls.

Remediation

View remediation

Remediation Suggestions

• Eliminate pickle for credential persistence. Store authorized-user credentials in a non-executable format such as JSON and load them through Google's supported credential APIs.
• Store credentials under a fixed, user-private configuration directory rather than the current working directory.
• Create the credential directory with owner-only permissions and reject credential files that are symbolic links, are not owned by the expected user, or are writable by other users.
• If legacy pickle migration is unavoidable, perform migration only after strict ownership and permission validation, then immediately write the credential in a safe format and delete the pickle.
• Treat any existing token.pickle file as potentially unsafe and do not deserialize files from shared or untrusted directories.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/upload.py:29

Finding

OAuth Credentials Written Without Explicit Access Restrictions

Content

View full analysis

Vulnerability Details

File Location: scripts/upload.py, lines 29-30
Vulnerability Type: Insecure sensitive-data storage
Risk Level: Medium

Vulnerable Code:

python

with open(token_file, 'wb') as token:
    pickle.dump(creds, token)

Technical Analysis

The application writes reusable Google OAuth credentials to token.pickle using the process's ambient umask. It does not explicitly require owner-only file permissions, create the file atomically, reject symbolic links, or place the token in a dedicated private credential directory.

The relative token path also means the credential is written into the current working directory. On a shared system, in a shared project directory, or under a permissive umask, another local principal may be able to read or replace the credential. Replacement also compounds the unsafe deserialization vulnerability because the same file is subsequently loaded with pickle.load().

Attack Path

1. The skill is executed from a shared or insufficiently protected directory, or under a permissive umask.
2. OAuth authentication succeeds and the script creates token.pickle.
3. Another local user or process with access to that directory reads the serialized credential or replaces the file.
4. A stolen reusable credential may be used to exercise the granted YouTube upload authorization, subject to Google's token controls.
5. If the file is replaced with a malicious pickle, a later invocation can trigger arbitrary code execution through the unsafe load operation.

Impact Assessment

Exposure may grant access to the OAuth authority represented by the token, which is limited in this project to the youtube.upload scope. This could permit unauthorized uploads to the associated YouTube account while the token remains valid. File replacement can additionally lead to code execution with the skill process's privileges due to the separate unsafe-deserialization flaw. Expl ...[truncated 139 chars]

Remediation

View remediation

Remediation Suggestions

• Store credentials in a dedicated per-user configuration directory created with mode 0700.
• Create the credential file atomically with mode 0600, independent of the ambient umask.
• Reject symbolic links and validate file ownership and permissions before reading or replacing the token.
• Use a safe credential format such as authorized-user JSON rather than pickle.
• Avoid placing OAuth credentials in the project or current working directory.
• Document that the token is sensitive, must not be committed or shared, and should be revoked through the Google account security interface if exposure is suspected.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:17

Finding

Unpinned Third-Party Dependency Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 17; also present in README.md, line 25
Vulnerability Type: Unpinned software supply-chain dependencies
Risk Level: Low

Vulnerable Code:

bash

pip3 install google-api-python-client google-auth-oauthlib google-auth-httplib2

Technical Analysis

The installation instructions resolve mutable latest versions of the listed packages and their transitive dependencies. No version constraints, lockfile, package hashes, or isolated virtual environment are specified.

The package names are consistent with the skill's documented Google API functionality, and there is no evidence in the reviewed project that they are intentionally malicious. Nevertheless, resolving mutable packages makes installations non-reproducible and causes future, unreviewed dependency code to be installed and imported by the skill.

Attack Path

1. A user follows the documented prerequisite command.
2. pip3 resolves the latest available releases and transitive dependencies from its configured package index.
3. A compromised, unexpectedly changed, or incompatible future release is downloaded and installed without hash verification.
4. Dependency-controlled code runs during installation or when upload.py imports and uses the package.
5. Any resulting impact occurs with the privileges of the user performing installation or running the skill.

Impact Assessment

The direct confirmed impact is a lack of reproducible and reviewable builds. If an upstream package, transitive dependency, package index, or configured mirror were compromised, malicious code could execute with the installing or runtime user's privileges. The reviewed files do not establish that such a compromise has occurred, so this is a supply-chain hardening issue rather than evidence of an active malicious dependency.

Remediation

View remediation

Remediation Suggestions

• Pin reviewed direct and transitive dependency versions in a requirements or lock file.
• Record and verify package hashes, such as by installing with pip's --require-hashes option.
• Install dependencies in a dedicated virtual environment rather than the global Python environment.
• Regularly update pins through a controlled review process that includes vulnerability and provenance checks.
• Configure pip to use trusted package indexes and prevent unintended fallback to untrusted mirrors.
• Update both SKILL.md and README.md so they reference the same maintained, hash-locked dependency file.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 17)May include surrounding context.

md

---
name: youtube-upload
description: "Uploads a video to YouTube using the official YouTube Data API v3 and OAuth 2.0. Use this skill when the user asks to upload a video to YouTube. It supports titles, descriptions, privacy settings (public, private, unlisted), and large file chunking. Requires a Google Cloud 'client_secret.json' file."
metadata:
  openclaw:
    emoji: "📺"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 49)May include surrounding context.

md

---
name: youtube-upload
description: "Uploads a video to YouTube using the official YouTube Data API v3 and OAuth 2.0. Use this skill when the user asks to upload a video to YouTube. It supports titles, descriptions, privacy settings (public, private, unlisted), and large file chunking. Requires a Google Cloud 'client_secret.json' file."
metadata:
  openclaw:
    emoji: "📺"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: youtube-upload
description: "Uploads a video to YouTube using the official YouTube Data API v3 and OAuth 2.0. Use this skill when the user asks to upload a video to YouTube. It supports titles, descriptions, privacy settings (public, private, unlisted), and large file chunking. Requires a Google Cloud 'client_secret.json' file."
metadata:
  openclaw:
    emoji: "📺"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

---
name: youtube-upload
description: "Uploads a video to YouTube using the official YouTube Data API v3 and OAuth 2.0. Use this skill when the user asks to upload a video to YouTube. It supports titles, descriptions, privacy settings (public, private, unlisted), and large file chunking. Requires a Google Cloud 'client_secret.json' file."
metadata:
  openclaw:
    emoji: "📺"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md

---
name: youtube-upload
description: "Uploads a video to YouTube using the official YouTube Data API v3 and OAuth 2.0. Use this skill when the user asks to upload a video to YouTube. It supports titles, descriptions, privacy settings (public, private, unlisted), and large file chunking. Requires a Google Cloud 'client_secret.json' file."
metadata:
  openclaw:
    emoji: "📺"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/upload.py (reported line 74)May include surrounding context.

python

---
name: youtube-upload
description: "Uploads a video to YouTube using the official YouTube Data API v3 and OAuth 2.0. Use this skill when the user asks to upload a video to YouTube. It supports titles, descriptions, privacy settings (public, private, unlisted), and large file chunking. Requires a Google Cloud 'client_secret.json' file."
metadata:
  openclaw:
    emoji: "📺"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README explicitly states that a persistent token.pickle will be created and that later uploads will occur silently and automatically, but it does not clearly warn users that this token represents ongoing delegated access to their YouTube account. In an agent context, silent reuse of OAuth tokens increases the chance of unintended uploads or account misuse if the local environment, token file, or invoking agent is compromised.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill explicitly performs network-capable actions against the YouTube API but does not declare any tool scope or permissions boundary. This can lead to overbroad execution in agent environments, where reviewers and runtime policy engines cannot clearly distinguish or constrain its external network behavior.

Content

No source excerpt is available for this finding.

Insecure deserialization: pickle.load()

Medium

• Category: Dangerous Code Execution
• Confidence: 96% confidence

Finding

The script deserializes credentials from a local token.pickle file using pickle.load(), which can execute arbitrary code during loading if the file is replaced or tampered with. In an agent skill context, this is more dangerous because the working directory and persisted artifacts may be influenced by other tasks, users, or compromised local state, turning a convenience token cache into a code-execution primitive.

Content

Scanner excerpt · scripts/upload.py (reported line 19)May include surrounding context.

python

if os.path.exists(token_file):
        with open(token_file, 'rb') as token:
            creds = pickle.load(token)
            
    if not creds or not creds.valid:
        if creds and creds.expired and creds.refresh_token:

Static analysis

No suspicious patterns detected.