Security checks for vulnerabilities and agentic risk
Overview
This YouTube helper is coherent, but it should be reviewed because it runs an always-latest external CLI and can persist credentials or use browser cookies.
Review before installing. Use only if you trust the `yt-mem-ai` package source and are comfortable with the agent running the latest package from the registry. Avoid enabling browser-cookie access or storing Webshare credentials unless necessary; prefer a dedicated browser profile, project-level secrets kept out of version control, and remove credentials when finished.
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T03 · Remote Payload Retrieval and Execution
Error
Location
SKILL.md:11
Finding
Unpinned Remote Package Retrieval and Execution
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 11–17 Vulnerability Type: Remote execution of an unpinned, mutable package Risk Level: High
Vulnerable Code
markdown
## Prereqs
- **Always invoke the CLI as `uvx yt-mem-ai <cmd>`** — zero-install, cached,
always latest. **Nothing is installed on PATH**: the native plugins ship skills
only, so do NOT go hunting for a `yt-ai` binary, a wrapper script, or a venv.
(Only inside a source checkout of this repo may you use `uv run yt-ai <cmd>`.)
Technical Analysis
The Skill explicitly requires uvx to resolve and execute the “always latest” version of the externally distributed yt-mem-ai package. No exact version, package hash, lockfile, signature, or trusted artifact digest is specified.
Consequently, the effective executable payload can change after this Skill has been reviewed. Every documented operation crosses this remote code-execution boundary, including commands that later receive access to local configuration, media files, browser cookies, proxy credentials, and subprocess functionality such as ffmpeg.
This is a supply-chain trust issue rather than evidence that the current yt-mem-ai release is malicious. Exploitation depends on compromise of the package publisher, distribution account, registry, release pipeline, or another mechanism capable of replacing the package version selected by uvx.
Attack Path
An attacker compromises the package publisher, release pipeline, registry account, or another relevant distribution component.
The attacker publishes a malicious version of yt-mem-ai as the latest release.
A user or agent follows the Skill and executes any uvx yt-mem-ai command.
uvx resolves and executes the attacker-controlled release because no reviewed version or digest is pinned.
The malicious package runs with the privileges of the invoking user.
It can inspect access
...[truncated 854 chars]
Remediation
View remediation
Remediation Suggestions
Replace “always latest” execution with an exact, reviewed package version:
bash
Adjust the syntax to the package manager’s supported version-pinning mechanism.
Verify package artifacts using cryptographic hashes or trusted signatures where supported.
Maintain a lockfile or equivalent immutable dependency manifest for all transitive dependencies.
Upgrade only through an explicit process involving source review, artifact verification, and security testing.
Run the package with restricted filesystem and network permissions, especially when browser cookies or proxy credentials are available.
Separate low-risk read-only operations from commands requiring media downloads, subprocess execution, or credential access.
Document the trusted package registry and reject unexpected indexes, mirrors, or dependency sources.
T09 · Insecure Skill Coding Practices
Warning
Location
SKILL.md:84
Finding
Persistent Secret Storage and Broad Browser Cookie Access
Content
View full analysis
Vulnerability Details
File Location: SKILL.md, lines 84–95 and 117–133 Vulnerability Type: Plaintext-style credential persistence and excessive access to browser authentication material Risk Level: Medium
Vulnerable Code
markdown
### Configure & maintain
```bash
uvx yt-mem-ai config list # every setting, value, and source
uvx yt-mem-ai config set KEY VALUE # e.g. WEBSHARE_PROXY_USERNAME, YT_EMBEDDING_MODEL
uvx yt-mem-ai config get KEY [--reveal] # secrets masked unless --reveal
uvx yt-mem-ai config unset KEY # remove from the config file
Use this to reconfigure the engine on request — set Webshare proxy creds, switch
the embedding model/backend, point at a cookies browser, change caption languages
— without hand-editing .env. set writes the global config
(~/.yt-mem-ai/config.env) by default; add --project for ./.env. Only known
.env keys are accepted.
text
```markdown
| Error | Cause | Fix |
|---|---|---|
| `YouTube bot check: ... Sign in to confirm you're not a bot` (exit 4) | yt-dlp (audio/metadata) needs a logged-in session | `uvx yt-mem-ai config set YT_COOKIES_BROWSER chrome` (or `brave`/`firefox`/`edge`/`safari`), then re-run |
| `captions blocked by YouTube (IP rate-limited)` (exit 3) | the transcript API is IP-blocked | cookies do **not** help — retry later, or set `YT_CAPTIONS_USE_WEBSHARE true` + `WEBSHARE_PROXY_USERNAME`/`WEBSHARE_PROXY_PASSWORD` |
| `no captions available` (exit 1) | video has no caption track | re-run with `--whisper` (downloads audio, slower) |
Set these with `config set`, not `KEY=value uvx …`: the config file persists
across runs, an env var only covers the single command you prefixed.
On macOS the first Chrome-cookie read may raise a Keychain prompt — if a command
hangs, tell the user to approve it.
Technical Analysis
The Skill directs users to persist Webshare
...[truncated 2732 chars]
Remediation
View remediation
Remediation Suggestions
Store proxy passwords in an operating-system credential manager rather than an environment-format file.
If file-based storage is unavoidable, create the file with owner-only permissions, validate those permissions before use, and refuse operation when the file is accessible to other users.
Ensure project-level .env files are excluded from version control by default and warn users before placing secrets inside a project directory.
Require explicit user confirmation before enabling browser-cookie or Keychain access.
Use a dedicated browser profile containing only the minimum YouTube session required for this workflow.
Enable cookie access only for the individual blocked operation and disable it afterward where practical.
Do not run unrelated read-only commands with access to browser cookies or proxy secrets. Separate credential-requiring commands into a restricted execution context.
Preserve secret masking and add safeguards around config get --reveal, such as interactive confirmation and prevention of secret output in logs.
Document credential rotation and revocation procedures for suspected exposure.
Pin and verify the CLI package before granting it access to any credential or browser session.
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Findings (36)
YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]
High
Category
YARA Match
Confidence
82% confidence
Finding
The instruction to configure YT_COOKIES_BROWSER to read a logged-in browser session resembles information-stealer behavior because it leverages browser-stored authentication material. In this skill context the stated purpose is to bypass YouTube bot checks, not credential theft, but it still creates real risk because it encourages access to sensitive browser cookies through an executable package.
Content
Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.
md
he **yt-mem-ai-desktop** repo
> (`yt-ai-desktop-serve`); it is not part of this engine CLI.
## When YouTube blocks a fetch
Two different blocks with two different fixes — read the message, don't guess.
| Error | Cause | Fix |
|---|---|---|
| `YouTube bot check: ... Sign in to confirm you're not a bot` (exit 4) | yt-dlp (audio/metadata) needs a logged-in session | `uvx yt-mem-ai config set YT_COOKIES_BROWSER chrome` (or `brave`/`firefox`/`edge`/`safari`), then re-run |
| `captions blocked by YouTube (IP rate-limited)` (exit 3) | the transcript API is IP-blocked | cookies do **not** help — retry later, or set `YT_CAPTIONS_USE_WEBSHARE true` + `WEBSHARE_PROXY_USERNAME`/`WEBSHARE_PROXY_PASSWORD` |
| `no captions available` (exit 1) | video has no caption track | re-run with `--whisper` (downloads audio, slower) |
Set these with `config set`, not `KEY=value uvx …`: the config file persists
across runs, an env var only covers the single command you prefixed.
On macOS the first Chro
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The manifest description is extremely broad and acts as an umbrella trigger for nearly any YouTube-related operation. Overbroad activation increases the likelihood that the skill is invoked in contexts the user did not intend, causing unnecessary execution of external tooling and expanding the attack surface.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill repeatedly instructs the agent to execute uvx yt-mem-ai without pinning a specific package version or artifact hash. Because uvx resolves and runs the latest available package, the behavior of this skill can change over time and could execute a compromised or malicious upstream release, creating a software supply-chain risk.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This invocation pattern uses uvx yt-mem-ai without a pinned version, so the skill depends on whatever package version is current at runtime. If the upstream package is hijacked or a bad release is published, the agent may execute attacker-controlled code.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The skill recommends running an unpinned remote package via uvx, which is a classic supply-chain exposure. Since this is an execution path, compromise of the package publisher or dependency chain could directly affect the host where the skill is used.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The generic command form uvx yt-mem-ai <command> is unpinned and therefore non-deterministic. This makes the skill operationally unsafe because the same skill content may execute materially different code in future sessions.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This fetch example relies on the latest uvx-resolved package rather than a reviewed version. Since the command downloads content and processes local/system resources, package compromise could lead to code execution or data access.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The transcript example invokes an unversioned package through uvx, exposing users to upstream release substitution. Because the skill strongly directs use of uvx, this risk is systemic rather than incidental.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The discover command is another execution path using an unpinned remote package. Supply-chain compromise would let an attacker influence all discovery workflows run through this skill.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
fetch-pending is documented through an unpinned uvx call, so runtime behavior can drift or become malicious with upstream changes. This is dangerous because the skill is intended as an operational entry point, increasing execution frequency.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The channel enumeration example still executes a latest-resolved package. An attacker controlling or compromising the package distribution could turn ordinary content operations into host compromise.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The list command uses the same unpinned uvx pattern, which is a direct supply-chain risk. Because the skill encourages frequent CLI use, the exposure is broad and persistent.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The show example is unpinned, leaving the agent dependent on whatever code the package registry serves at runtime. A compromised or malicious release could abuse access to stored transcript and metadata content.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The status command continues the same unsafe package execution model. Even read-oriented commands can be dangerous when the executable itself is not fixed to a reviewed version.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The search command runs an unversioned package, which can introduce arbitrary code changes via normal package updates. Since search may be used as part of larger agent-driven workflows, compromise could cascade into many tasks.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The save-summary command is executed through an unpinned uvx package, so even write operations to the video library depend on mutable upstream code. This can enable tampering, exfiltration, or code execution if the package supply chain is compromised.
Content
No source excerpt is available for this finding.
Session Persistence
Medium
Category
Rogue Agent
Confidence
60% confidence
Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content
Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
Do **not** write summaries free-hand here. For the model-generated analysis
(summary + timestamped highlights + Q&A + presentation, a subscription digest, or
a cross-video review), hand off to **[[yt-agent]]**.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The like command is another unpinned executable reference. The cumulative pattern across the file shows deliberate reliance on 'always latest,' which materially increases supply-chain exposure.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The dislike example executes an unreviewed-at-runtime package version. This is a true vulnerability because the risk is in code acquisition and execution, not the specific command semantics.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The recommendation command uses uvx without version pinning, preserving the same supply-chain weakness. If exploited, attacker code would run in the context of the user invoking the skill.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The configuration listing example still resolves yt-mem-ai dynamically at runtime. Because config commands interact with settings and potentially secrets, package compromise would be especially sensitive here.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
This config set example runs an unpinned package that may process credentials and other sensitive configuration values. A malicious upstream release could capture or misuse those inputs.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The skill exposes commands for setting proxy usernames, passwords, and other sensitive configuration but does not explicitly warn that these are secrets or require careful handling. In an agent context, this can lead to credentials being entered into chat, logs, transcripts, or shell history and then persisted in a config file.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The config get example uses an unpinned runtime dependency, creating the same supply-chain execution risk. Because it can reveal secret values with flags like --reveal, the context increases potential damage.
Content
No source excerpt is available for this finding.
Rp1
Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding
The config unset example continues the unpinned execution pattern. While functionally simple, it still exposes the host to arbitrary upstream code execution risk.
