yt-mem

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

The skill is coherent for managing a YouTube memory CLI, but it asks agents to run mutable third-party code and to grant that code sensitive cookie and credential access without enough safeguards.

Install only if you are comfortable with an agent fetching and running the current `yt-mem-ai` package at use time. Prefer a pinned reviewed version, a sandbox, and a dedicated browser profile for YouTube cookies. Do not grant Keychain/browser-cookie access or store proxy passwords unless you understand where the values will be stored and how to remove or rotate them.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:13

Finding

Unpinned Runtime Execution of an Automatically Updated Third-Party Package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-15
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code:

text

- **Always invoke the CLI as `uvx yt-mem-ai <cmd>`** — zero-install, cached,
  always latest. **Nothing is installed on PATH**: the native plugins ship skills
  only, so do NOT go hunting for a `yt-ai` binary, a wrapper script, or a venv.

Technical Analysis

The Skill requires every operation to execute the newest available version of the external yt-mem-ai package through uvx. No reviewed version, package hash, lockfile, or other integrity constraint is specified. Consequently, the code that runs can change after the Skill itself has been audited.

Runtime package execution gives the downloaded package the privileges of the invoking user, including available filesystem, environment, subprocess, and network access. This risk is amplified because other documented workflows may grant the same package access to browser cookies and persistent proxy credentials.

This is an insecure supply-chain design. The available evidence does not establish that the current package is malicious, but the “always latest” requirement makes the effective execution payload mutable and prevents reproducible security review.

Attack Path

1. An attacker compromises the upstream package, its publisher account, a transitive dependency, or the package distribution channel.
2. The attacker publishes a modified version under the expected package identity.
3. The Agent follows the Skill and invokes an ordinary uvx yt-mem-ai operation.
4. uvx obtains or executes the latest compromised release.
5. Malicious package code runs with the user's privileges and can access data available to that process.
6. If browser-cookie or proxy configuration has also been enabled, the compromised package may attempt to access those sensitive resources.

Impa

...[truncated 408 chars]

Remediation

View remediation

Remediation Suggestions

• Pin yt-mem-ai to a specifically reviewed version rather than requesting “always latest.”
• Use a lockfile and package hashes or signatures to verify package integrity.
• Document and restrict the authoritative package registry and publisher identity.
• Review transitive dependencies and adopt an explicit, controlled update process.
• Run the CLI in a sandbox with narrowly scoped filesystem and network permissions.
• Separate credential-bearing operations from ordinary package execution, and do not expose credentials to newly updated versions until they have been reviewed.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:121

Finding

Sensitive Browser Cookie and Keychain Access Granted to the CLI

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 121-130
Vulnerability Type: Excessive credential-store access
Risk Level: High

Vulnerable Code:

text

| Error | Cause | Fix |
|---|---|---|
| `YouTube bot check: ... Sign in to confirm you're not a bot` (exit 4) | yt-dlp (audio/metadata) needs a logged-in session | `uvx yt-mem-ai config set YT_COOKIES_BROWSER chrome` (or `brave`/`firefox`/`edge`/`safari`), then re-run |
| `captions blocked by YouTube (IP rate-limited)` (exit 3) | the transcript API is IP-blocked | cookies do **not** help — retry later, or set `YT_CAPTIONS_USE_WEBSHARE true` + `WEBSHARE_PROXY_USERNAME`/`WEBSHARE_PROXY_PASSWORD` |
| `no captions available` (exit 1) | video has no caption track | re-run with `--whisper` (downloads audio, slower) |

Set these with `config set`, not `KEY=value uvx …`: the config file persists
across runs, an env var only covers the single command you prefixed.
On macOS the first Chrome-cookie read may raise a Keychain prompt — if a command
hangs, tell the user to approve it.

Technical Analysis

The Skill instructs the Agent to configure the CLI to read cookies from a user's normal browser profile and to encourage approval of a macOS Keychain prompt. Browser cookie databases can contain authenticated session material, and Keychain authorization represents a significant expansion of the CLI's access.

Access to YouTube authentication cookies can be functionally relevant when YouTube blocks unauthenticated downloads. However, the Skill does not require explicit informed consent immediately before cookie access, does not recommend an isolated browser profile, and does not establish that the implementation filters access strictly to required YouTube domains.

Because the implementation of yt-mem-ai is absent from the project and the package is executed as an unpinned dependency, the actual cookie-selection and credential-handling controls cannot b ...[truncated 1134 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, informed user confirmation immediately before enabling browser-cookie access.
• Explain what credential source will be accessed and why it is required.
• Recommend a dedicated browser profile containing only the minimum YouTube authentication state.
• Ensure the implementation filters extracted cookies to the exact required YouTube domains and names.
• Do not automatically retry with cookies or request Keychain approval without user authorization.
• Prefer an explicitly exported, narrowly scoped YouTube cookie file over unrestricted access to a primary browser profile.
• Sandbox the CLI and prevent access to unrelated browser profiles and credential stores.
• Pin and review the CLI version before granting it credential access.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:84

Finding

Persistent Plaintext Storage of Proxy Credentials in Environment Files

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 84-93 and 123-128
Vulnerability Type: Insecure persistent credential storage
Risk Level: Medium

Vulnerable Code:

text

uvx yt-mem-ai config list                     # every setting, value, and source
uvx yt-mem-ai config set KEY VALUE            # e.g. WEBSHARE_PROXY_USERNAME, YT_EMBEDDING_MODEL
uvx yt-mem-ai config get KEY [--reveal]       # secrets masked unless --reveal
uvx yt-mem-ai config unset KEY                # remove from the config file

text

Use this to reconfigure the engine on request — set Webshare proxy creds, switch
the embedding model/backend, point at a cookies browser, change caption languages
— without hand-editing `.env`. `set` writes the global config
(`~/.yt-mem-ai/config.env`) by default; add `--project` for `./.env`. Only known
`.env` keys are accepted.

text

| `captions blocked by YouTube (IP rate-limited)` (exit 3) | the transcript API is IP-blocked | cookies do **not** help — retry later, or set `YT_CAPTIONS_USE_WEBSHARE true` + `WEBSHARE_PROXY_USERNAME`/`WEBSHARE_PROXY_PASSWORD` |

Set these with `config set`, not `KEY=value uvx …`: the config file persists
across runs, an env var only covers the single command you prefixed.

Technical Analysis

The Skill recommends persisting Webshare proxy usernames and passwords in either ~/.yt-mem-ai/config.env or a project-local ./.env. Masking secrets in config get output does not encrypt or otherwise protect values stored in the underlying file.

The instructions do not document owner-only file permissions, operating-system credential-store integration, encryption at rest, repository checks, or warnings before creating a project-local credential file. A project .env is particularly susceptible to accidental source-control commits, workspace indexing, backups, and access by unrelated project tools.

Passing a secret as `config set KEY V ...[truncated 1280 chars]

Remediation

View remediation

Remediation Suggestions

• Store proxy passwords in the operating system's credential manager rather than in .env files.
• If file storage is unavoidable, create the file with owner-only permissions and validate permissions before reading it.
• Avoid passing passwords directly as command-line arguments; use secure interactive input or standard input without echo.
• Warn users before persisting a secret and clearly identify its destination.
• Disable project-local secret storage by default.
• If project-local storage is necessary, verify that the file is excluded from source control and refuse to write into a tracked file.
• Provide credential rotation and secure deletion guidance.
• Ensure all configuration-listing and diagnostic commands consistently redact secret values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (35)

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · SKILL.md (reported line 123)May include surrounding context.

md

he **yt-mem-ai-desktop** repo
> (`yt-ai-desktop-serve`); it is not part of this engine CLI.

## When YouTube blocks a fetch

Two different blocks with two different fixes — read the message, don't guess.

| Error | Cause | Fix |
|---|---|---|
| `YouTube bot check: ... Sign in to confirm you're not a bot` (exit 4) | yt-dlp (audio/metadata) needs a logged-in session | `uvx yt-mem-ai config set YT_COOKIES_BROWSER chrome` (or `brave`/`firefox`/`edge`/`safari`), then re-run |
| `captions blocked by YouTube (IP rate-limited)` (exit 3) | the transcript API is IP-blocked | cookies do **not** help — retry later, or set `YT_CAPTIONS_USE_WEBSHARE true` + `WEBSHARE_PROXY_USERNAME`/`WEBSHARE_PROXY_PASSWORD` |
| `no captions available` (exit 1) | video has no caption track | re-run with `--whisper` (downloads audio, slower) |

Set these with `config set`, not `KEY=value uvx …`: the config file persists
across runs, an env var only covers the single command you prefixed.
On macOS the first Chro

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest description activates for 'any yt-ai operation' across ingest, discovery, search, recommendation, summarization, compilation, and full pipelines. That breadth increases the chance the skill is invoked in contexts broader than necessary, which can lead the agent to perform networked or write-capable actions when a narrower, safer skill would suffice.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill repeatedly instructs the agent to execute uvx yt-mem-ai without pinning an exact package version or hash. Because uvx resolves and runs the latest published package, a compromised upstream release, typosquatted dependency, or malicious maintainer update could cause arbitrary code execution when the skill is used.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This invocation pattern uses uvx yt-mem-ai with no version pinning, which means the executed code can change over time without review. In an agent skill, that creates a remote supply-chain execution path from package registry updates directly into user sessions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This duplicate occurrence on the same line still represents the same underlying supply-chain risk: uvx will fetch and run the latest package unless constrained. An attacker controlling the package or one of its dependencies could gain code execution through normal skill use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The generic command template shows unpinned execution of an external package. In a skill file, this is operationally equivalent to instructing the agent to trust mutable remote code at runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The single-video ingest command fetches and executes an unpinned CLI package. Because this skill is an entry point for many operations, compromise of the package would have broad reach and could affect local files, network calls, and stored video/transcript data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This alias command also relies on unpinned uvx execution. The danger is not the specific subcommand but the mutable package resolution, which can turn routine transcript actions into arbitrary code execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The discovery workflow runs a latest-version package from the registry with no pin. That introduces a supply-chain vulnerability into an automated batch workflow that may be run regularly and unsupervised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The batch fetch workflow compounds the risk of unpinned package execution because it is likely to be used repeatedly and at scale. A malicious update could automate exfiltration or destructive behavior during normal ingestion jobs.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The channel enumeration command uses the same unpinned package execution pattern. The vulnerability stems from trusting a mutable upstream artifact at execution time rather than a stable vetted binary.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Listing library data through an unpinned uvx package remains a code execution risk regardless of the subcommand's apparent harmlessness. Attackers often rely on innocuous-looking commands to gain initial execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The show command example still inherits the same supply-chain threat from unversioned uvx invocation. Since the skill encourages reading stored transcripts, a malicious package could also tamper with or leak that data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The status command is presented as safe operational usage, but it executes mutable external code. This mismatch can lower user caution and increase exploitability if the upstream package changes unexpectedly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Search operations are also routed through unpinned uvx, preserving the same remote package trust problem. Given that search may be used interactively and often, the attack surface is recurring and convenient for exploitation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Saving summaries via an unpinned package allows a compromised release to alter or exfiltrate persisted analysis content. Because this subcommand writes data, malicious behavior could silently poison the library or embed harmful content.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

uvx yt-mem-ai save-summary <video_id> "<summary_md>"
--highlights '' --qa ''

text

Do **not** write summaries free-hand here. For the model-generated analysis
(summary + timestamped highlights + Q&A + presentation, a subscription digest, or
a cross-video review), hand off to **[[yt-agent]]**.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The like command continues the unpinned uvx execution pattern. Even though the action is small, it still grants arbitrary package code a chance to run in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The dislike command is another instance of mutable remote package execution. Repetition throughout the skill makes the unsafe pattern pervasive and likely to be followed without scrutiny.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Recommendation generation is routed through an unversioned package fetch-and-run flow. A malicious upstream release could tamper with rankings, access local data, or execute arbitrary payloads during routine use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Configuration listing via an unpinned package can expose sensitive values if the package is compromised. Since config operations often touch secrets and file locations, the supply-chain risk here is more operationally sensitive than a simple read-only task may suggest.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Setting configuration through an unpinned external package is particularly risky because it may involve credentials or proxy settings. A malicious release could intercept secrets at entry time or rewrite configuration to persist compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Getting configuration, especially with --reveal, through an unpinned package increases the chance of secret disclosure if the package is compromised. This creates a direct path from supply-chain compromise to credential exfiltration.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Unsetting configuration is another write-capable operation executed through mutable package resolution. An attacker could abuse this path to disable protections or alter the application's trusted settings.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Re-embedding the full library via an unpinned package gives a malicious release broad access to stored content and write operations over the entire data set. That amplifies the impact of the same underlying supply-chain weakness.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.