Security audit

youtube-manager

Security checks for vulnerabilities and agentic risk

Overview

This YouTube skill is not clearly malicious, but it overstates what it can do and includes a mock upload path that can falsely report success.

Review before installing. Treat the upload feature as a stub, not a real YouTube upload workflow, and do not rely on its success output for publishing decisions. If you use this skill, keep YouTube API keys, client secrets, and refresh tokens in a protected secret store, restrict OAuth scopes, and require explicit user confirmation before any real account-changing publishing workflow is added.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code’s actual function is limited to fetching basic YouTube channel and video metadata/statistics via GET requests to the YouTube Data API. It supports channel analysis and basic monitoring, which partially matches the description. However, the declared purpose materially overstates the capability: there is no code for publishing or uploading videos, no write operations, no report generation beyond console printing, and no comprehensive channel management or end-to-end workflow automation. This is a description-behavior mismatch due to significant declared capabilities not present in the implementation.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description overstates the skill's scope. This code chunk is narrowly focused on assembling a YouTube analytics report from input dictionaries/lists, generating simple recommendations, and saving the result to a JSON file. There is no interaction with YouTube APIs, no channel management actions, no video upload/publishing, and no active monitoring workflow. While report generation and analytics are consistent with part of the description, the primary declared purpose of comprehensive channel management and end-to-end YouTube automation is not supported by the supplied code.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises a broad YouTube management capability: publishing, analytics, monitoring, and report generation. The supplied code only validates a local file path, builds metadata, and returns a hardcoded/mock upload result. Although the script is framed as an upload utility, it does not actually interact with YouTube or perform a real upload. There are no analytics, reporting, or channel management functions present. This is therefore a material description-to-behavior mismatch, mainly because the actual code is much narrower and partly simulated compared with the declared end-to-end YouTube automation capability.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill advertises API-driven YouTube management but declares no explicit tool scope or permission boundaries. In an agent environment, missing permissions or allowed-tools can allow broader-than-expected access to environment variables and network operations, increasing the risk of credential exposure or unauthorized outbound actions if the skill is invoked.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger phrases are broad enough that the skill may activate on common YouTube-related requests, including cases where the user did not intend automation or publishing behavior. In a skill capable of network access or account operations, overbroad activation increases the chance of unintended use, accidental disclosure of analytics data, or unintended account actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill describes analytics monitoring, report generation, alerts, and video publishing without prominent warnings about privacy, account scope, credential handling, or the consequences of automated publishing. In this context, users may expose channel data or trigger publication actions without informed consent, especially if the skill is selected automatically or used by less technical operators.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The guide instructs users to place highly sensitive OAuth credentials, including a client secret and refresh token, into environment variables but provides no warning about secure storage, rotation, access control, or the risks of leakage through logs, shell history, process inspection, CI/CD output, or shared deployment environments. In a skill that enables YouTube publishing and analytics access, compromise of these values could allow unauthorized access to private channel data and potentially video upload or account actions, making the omission security-relevant rather than merely informational.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The function and its documentation claim to upload a video to YouTube, but the implementation only validates inputs and returns a hardcoded success response. In an automation skill for channel management, this can mislead downstream agents or users into believing publication succeeded, causing workflow integrity failures, false reporting, and potential business or operational impact.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises end-to-end YouTube publishing, but this code path merely simulates a successful upload with a fixed video ID and success status. In the context of a channel-management automation skill, that mismatch is security-relevant because other components may make trust decisions, trigger follow-on actions, or generate reports based on fabricated state.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file forces a specific language for all instructions and does not indicate that users may choose another language or that the skill is intentionally limited to a Chinese-speaking context. The policy for natural-language content says locale-specific constraints should be opt-in or clearly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The metadata helper defaults the video's language to "en", which imposes a specific language/locale choice unless the caller explicitly overrides it. This is a natural-language policy concern because the skill silently assumes English rather than prompting for or documenting a user language choice.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.