Security audit

YouTube Music

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it asks users to store sensitive YouTube Music browser session data in plaintext without adequate safeguards.

Review this before installing. Treat headers.txt and browser.json like passwords: keep them out of source control and shared folders, restrict file permissions, delete headers.txt after generating browser.json, and revoke or rotate the browser session if either file is exposed. Prefer a safer supported ytmusicapi authentication flow and install dependencies in an isolated, pinned environment.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:17
Finding: Unpinned Third-Party Dependency Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:22
Finding: Plaintext Storage of Authenticated Browser Request and Session Credentials
Content: View full analysis
Library** on the page. - Look for a request named `browse` in the network list. - **Right-click** the `browse` request -> **Copy -> Copy as cURL (bash)**. - Paste that cURL command into a file named `headers.txt` in the skill folder. - Run the following Python snippet to generate `browser.json`: ```python from ytmusicapi.auth.browser import setup_browser with open('headers.txt', 'r') as f: setup_browser('browser.json', f.read()) ``` - Ensure `browser.json` is located in the skill folder. ``` ### Technical Analysis A browser request copied as cURL may contain sensitive cookies, authorization headers, account identifiers, and other session-bound values. The instructions explicitly write that request to `headers.txt` and then derive `browser.json` from it. Both files are placed in the skill directory without instructions to apply owner-only permissions, exclude them from source control, encrypt them, or delete the intermediate `headers.txt` file. Keeping the original cURL request unnecessarily duplicates sensitive authentication data. The documented workflows include reading library data and changing songs or playlists. Consequently, disclosure of valid authentication material could enable actions within the authenticated YouTube Music session. Exploitability depends on whether the credentials remain valid and whether an attacker can read the files; the documentation does not itself transmit the credentials to an external party. ### At ...[truncated 1440 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the user to copy a browser request as cURL and save it to a local file, which can capture highly sensitive session headers and cookies. Without explicit warnings, minimization steps, or secure handling guidance, users may inadvertently expose reusable authentication material in plaintext files, shell history, logs, or version control.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.