Security audit

YouTube API

Security checks for vulnerabilities and agentic risk

Overview

This is a YouTube/MyBrandMetrics API helper, but it exposes powerful account-changing and destructive YouTube actions more broadly than the main description makes clear.

Review this carefully before installing. Use it only with a MyBrandMetrics key you are comfortable granting YouTube read/write/upload authority to, keep MYBRANDMETRICS_API_BASE_URL fixed to the official API host, and require explicit confirmation with the account, endpoint, target resource ID, and intended result before any upload, delete, update, moderation, subscription, playlist, live-stream, or reporting-job action.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

Location: references/curl.md:7
Finding: Unvalidated API Base URL Can Expose API Credentials and Uploaded Files
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (63)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.
X-API-Key: YOUR_API_KEY

text
Do not put real API keys, account session values, or Google access tokens in skill files, examples, logs, or chat replies. ## Discovery Routing

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The catalog exposes many high-risk state-changing operations—deletes, inserts, updates, moderation, uploads, and live-broadcast controls—while the skill description is framed primarily as data retrieval and analytics access. This capability mismatch increases the chance that an agent or user invokes destructive or account-affecting actions without understanding the skill’s true authority, especially because powerful OAuth scopes are included across the catalog.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 85% confidence
Finding: Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.
Content: Scanner excerpt · references/curl.md (reported line 84)May include surrounding context.
md
For multipart uploads, use `-F` and explicitly define the metadata content type. For resumable uploads, include upload content headers and then upload bytes to the resumable upload session URL when the API returns one. ## Downloads

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/services/youtube-analytics-v2.md (reported line 11)May include surrounding context.
md
## Method Index ### groupItems - `youtubeAnalytics.groupItems.delete` - `DELETE /v2/groupItems` - `youtubeAnalytics.groupItems.insert` - `POST /v2/groupItems` - `youtubeAnalytics.groupItems.list` - `GET /v2/groupItems`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · references/services/youtube-analytics-v2.md (reported line 16)May include surrounding context.
md
- `youtubeAnalytics.groupItems.list` - `GET /v2/groupItems` ### groups - `youtubeAnalytics.groups.delete` - `DELETE /v2/groups` - `youtubeAnalytics.groups.insert` - `POST /v2/groups` - `youtubeAnalytics.groups.list` - `GET /v2/groups` - `youtubeAnalytics.groups.update` - `PUT /v2/groups`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: The delete method is documented with 'Required parameters: none' even though the parameter table shows an id selector, and the provided curl example omits that identifier entirely. In an agent/tooling context, this ambiguity can enable unsafe invocation patterns, accidental broad deletes, or implementation-specific defaults that remove the wrong resource if the wrapper does not strictly validate inputs.
Content: Scanner excerpt · references/services/youtube-analytics-v2.md (reported line 29)May include surrounding context.
md
### `youtubeAnalytics.groupItems.delete` - Resource: `groupItems` - HTTP: `DELETE /v2/groupItems` - Required parameters: none - OAuth scopes: `https://www.googleapis.com/auth/youtube`, `https://www.googleapis.com/auth/youtube.readonly`, `https://www.googleapis.com/auth/youtubepartner`, `https://www.googleapis.com/auth/yt-analytics-monetary.readonly`, `https://www.googleapis.com/auth/yt-analytics.readonly` - Request schema: `none`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 81% confidence
Finding: This destructive groups.delete operation is likewise documented as having no required parameters while its parameter table defines an id used to select the target group, and the sample request omits it. In an agent-integrated skill, such mismatch increases the risk of parameter abuse, accidental deletion, or wrapper bugs that perform an unintended delete against the wrong or default resource.
Content: Scanner excerpt · references/services/youtube-analytics-v2.md (reported line 107)May include surrounding context.
md
### `youtubeAnalytics.groups.delete` - Resource: `groups` - HTTP: `DELETE /v2/groups` - Required parameters: none - OAuth scopes: `https://www.googleapis.com/auth/youtube`, `https://www.googleapis.com/auth/youtube.readonly`, `https://www.googleapis.com/auth/youtubepartner`, `https://www.googleapis.com/auth/yt-analytics-monetary.readonly`, `https://www.googleapis.com/auth/yt-analytics.readonly` - Request schema: `none`

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill metadata frames this capability as primarily search, metadata inspection, analytics, and reporting, but the documented API surface includes many write, moderation, and destructive operations. That mismatch increases the chance an agent or user will invoke powerful state-changing actions under the assumption the skill is read-oriented, leading to accidental account or content modifications.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The method index prominently exposes destructive endpoints such as caption deletion in a general-purpose skill, creating a broad tool surface that an agent could misuse through prompt manipulation, ambiguous instructions, or operator error. In this context, merely exposing delete-capable tools without strong separation or warnings increases the likelihood of harmful state changes.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 17)May include surrounding context.
md
- `youtube.activities.list` - `GET /youtube/v3/activities` ### captions - `youtube.captions.delete` - `DELETE /youtube/v3/captions` - `youtube.captions.download` - `GET /youtube/v3/captions/{id}` - `youtube.captions.insert` - `POST /youtube/v3/captions` - `youtube.captions.list` - `GET /youtube/v3/captions`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Channel section deletion is a state-changing administrative action that is inconsistent with a mainly data-access framing and can be invoked with a simple identifier. This increases the risk of accidental or manipulated removal of channel configuration by an agent operating on incomplete intent signals.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 27)May include surrounding context.
md
- `youtube.channelBanners.insert` - `POST /youtube/v3/channelBanners/insert` ### channelSections - `youtube.channelSections.delete` - `DELETE /youtube/v3/channelSections` - `youtube.channelSections.insert` - `POST /youtube/v3/channelSections` - `youtube.channelSections.list` - `GET /youtube/v3/channelSections` - `youtube.channelSections.update` - `PUT /youtube/v3/channelSections`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: Comment deletion and spam/moderation functions can directly suppress user speech and alter public-facing content. In an agentic workflow, this is dangerous because malicious prompts or misinterpreted moderation requests can trigger irreversible content actions against the wrong comments.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 41)May include surrounding context.
md
- `youtube.commentThreads.list` - `GET /youtube/v3/commentThreads` ### comments - `youtube.comments.delete` - `DELETE /youtube/v3/comments` - `youtube.comments.insert` - `POST /youtube/v3/comments` - `youtube.comments.list` - `GET /youtube/v3/comments` - `youtube.comments.markAsSpam` - `POST /youtube/v3/comments/markAsSpam`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Broadcast deletion and transition actions can disrupt live operations and audience access with immediate operational impact. Exposing these actions in a broad skill makes prompt-driven misuse or mistaken execution significantly more dangerous than ordinary data retrieval.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 56)May include surrounding context.
md
### liveBroadcasts - `youtube.liveBroadcasts.bind` - `POST /youtube/v3/liveBroadcasts/bind` - `youtube.liveBroadcasts.delete` - `DELETE /youtube/v3/liveBroadcasts` - `youtube.liveBroadcasts.insert` - `POST /youtube/v3/liveBroadcasts` - `youtube.liveBroadcasts.insertCuepoint` - `POST /youtube/v3/liveBroadcasts/cuepoint` - `youtube.liveBroadcasts.list` - `GET /youtube/v3/liveBroadcasts`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Live chat ban operations enable direct enforcement against users and can be abused to silence participants or sabotage events. Given the skill’s broad framing, these tools are more dangerous because users may not expect enforcement power to be present.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 64)May include surrounding context.
md
- `youtube.liveBroadcasts.update` - `PUT /youtube/v3/liveBroadcasts` ### liveChatBans - `youtube.liveChatBans.delete` - `DELETE /youtube/v3/liveChat/bans` - `youtube.liveChatBans.insert` - `POST /youtube/v3/liveChat/bans` ### liveChatMessages

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Live chat message deletion can alter real-time community interactions and cover tracks during abuse or moderation mistakes. The agent context makes this especially risky because a single malformed instruction can remove the wrong messages at scale or in sensitive moments.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 68)May include surrounding context.
md
- `youtube.liveChatBans.insert` - `POST /youtube/v3/liveChat/bans` ### liveChatMessages - `youtube.liveChatMessages.delete` - `DELETE /youtube/v3/liveChat/messages` - `youtube.liveChatMessages.insert` - `POST /youtube/v3/liveChat/messages` - `youtube.liveChatMessages.list` - `GET /youtube/v3/liveChat/messages` - `youtube.liveChatMessages.transition` - `POST /youtube/v3/liveChat/messages/transition`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Moderator management changes trust boundaries inside a live chat and can either strip legitimate operators or grant abusive privileges. Broad exposure of moderator add/remove actions materially raises the impact of prompt injection or operator confusion.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 74)May include surrounding context.
md
- `youtube.liveChatMessages.transition` - `POST /youtube/v3/liveChat/messages/transition` ### liveChatModerators - `youtube.liveChatModerators.delete` - `DELETE /youtube/v3/liveChat/moderators` - `youtube.liveChatModerators.insert` - `POST /youtube/v3/liveChat/moderators` - `youtube.liveChatModerators.list` - `GET /youtube/v3/liveChat/moderators`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: Live stream deletion affects production infrastructure and can interrupt or destroy streaming configurations. This is a powerful administrative capability that should not be casually reachable from a skill presented as a YouTube data integration.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 79)May include surrounding context.
md
- `youtube.liveChatModerators.list` - `GET /youtube/v3/liveChat/moderators` ### liveStreams - `youtube.liveStreams.delete` - `DELETE /youtube/v3/liveStreams` - `youtube.liveStreams.insert` - `POST /youtube/v3/liveStreams` - `youtube.liveStreams.list` - `GET /youtube/v3/liveStreams` - `youtube.liveStreams.update` - `PUT /youtube/v3/liveStreams`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Playlist image deletion is less severe than broadcast or video deletion but still allows unauthorized or accidental modification of public channel presentation. The danger comes from exposing write/delete actions without clear separation from benign read methods.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 91)May include surrounding context.
md
- `youtube.membershipsLevels.list` - `GET /youtube/v3/membershipsLevels` ### playlistImages - `youtube.playlistImages.delete` - `DELETE /youtube/v3/playlistImages` - `youtube.playlistImages.insert` - `POST /youtube/v3/playlistImages` - `youtube.playlistImages.list` - `GET /youtube/v3/playlistImages` - `youtube.playlistImages.update` - `PUT /youtube/v3/playlistImages`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Playlist item deletion changes published content curation and can remove videos from playlists with user-visible effects. This is risky in an agentic environment because simple ID-based destructive actions are easy to trigger accidentally or via prompt manipulation.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 97)May include surrounding context.
md
- `youtube.playlistImages.update` - `PUT /youtube/v3/playlistImages` ### playlistItems - `youtube.playlistItems.delete` - `DELETE /youtube/v3/playlistItems` - `youtube.playlistItems.insert` - `POST /youtube/v3/playlistItems` - `youtube.playlistItems.list` - `GET /youtube/v3/playlistItems` - `youtube.playlistItems.update` - `PUT /youtube/v3/playlistItems`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Playlist deletion is destructive and can remove curated collections relied upon by audiences and workflows. Exposing it alongside read/list methods without strong safeguards creates a meaningful misuse path.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 103)May include surrounding context.
md
- `youtube.playlistItems.update` - `PUT /youtube/v3/playlistItems` ### playlists - `youtube.playlists.delete` - `DELETE /youtube/v3/playlists` - `youtube.playlists.insert` - `POST /youtube/v3/playlists` - `youtube.playlists.list` - `GET /youtube/v3/playlists` - `youtube.playlists.update` - `PUT /youtube/v3/playlists`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 88% confidence
Finding: Subscription insert/delete operations allow the agent to alter user account relationships and preferences, which is outside a narrow analytics/data purpose. While lower impact than content deletion, they still represent unauthorized account actions if misused.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 112)May include surrounding context.
md
- `youtube.search.list` - `GET /youtube/v3/search` ### subscriptions - `youtube.subscriptions.delete` - `DELETE /youtube/v3/subscriptions` - `youtube.subscriptions.insert` - `POST /youtube/v3/subscriptions` - `youtube.subscriptions.list` - `GET /youtube/v3/subscriptions`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: Third-party link deletion/update capabilities can change channel commerce or integration relationships and may affect monetization or external platform bindings. These are sensitive business operations that are especially dangerous when hidden inside a broadly described data skill.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 123)May include surrounding context.
md
- `youtube.tests.insert` - `POST /youtube/v3/tests` ### thirdPartyLinks - `youtube.thirdPartyLinks.delete` - `DELETE /youtube/v3/thirdPartyLinks` - `youtube.thirdPartyLinks.insert` - `POST /youtube/v3/thirdPartyLinks` - `youtube.thirdPartyLinks.list` - `GET /youtube/v3/thirdPartyLinks` - `youtube.thirdPartyLinks.update` - `PUT /youtube/v3/thirdPartyLinks`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 97% confidence
Finding: Video deletion is one of the highest-risk actions in the file because it can irreversibly remove channel content and business value. In an LLM-agent environment, presenting this as a normal tool without strong gating creates a substantial risk of catastrophic accidental or manipulated misuse.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 141)May include surrounding context.
md
- `youtube.videoTrainability.get` - `GET /youtube/v3/videoTrainability` ### videos - `youtube.videos.delete` - `DELETE /youtube/v3/videos` - `youtube.videos.getRating` - `GET /youtube/v3/videos/getRating` - `youtube.videos.insert` - `POST /youtube/v3/videos` - `youtube.videos.list` - `GET /youtube/v3/videos`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The detailed caption delete method further operationalizes destructive use by showing required parameters and ready-to-run examples. This lowers the barrier for accidental or malicious execution against caption assets.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 225)May include surrounding context.
md
### `youtube.captions.delete` - Resource: `captions` - HTTP: `DELETE /youtube/v3/captions` - Required parameters: `id` - OAuth scopes: `https://www.googleapis.com/auth/youtube.force-ssl`, `https://www.googleapis.com/auth/youtubepartner` - Request schema: `none`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 94% confidence
Finding: Detailed documentation for channel section deletion makes a configuration-destructive action easily accessible with minimal context. That is risky because it enables low-friction misuse against public channel layout.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 434)May include surrounding context.
md
### `youtube.channelSections.delete` - Resource: `channelSections` - HTTP: `DELETE /youtube/v3/channelSections` - Required parameters: `id` - OAuth scopes: `https://www.googleapis.com/auth/youtube`, `https://www.googleapis.com/auth/youtube.force-ssl`, `https://www.googleapis.com/auth/youtubepartner` - Request schema: `none`

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 96% confidence
Finding: The detailed comment delete endpoint enables direct removal of user-generated content with only an ID, which is highly sensitive in moderation and reputational terms. This is dangerous because it can be abused to censor, retaliate, or hide evidence of abuse.
Content: Scanner excerpt · references/services/youtube-data-v3.md (reported line 678)May include surrounding context.
md
### `youtube.comments.delete` - Resource: `comments` - HTTP: `DELETE /youtube/v3/comments` - Required parameters: `id` - OAuth scopes: `https://www.googleapis.com/auth/youtube.force-ssl` - Request schema: `none`

Static analysis

No suspicious patterns detected.