YouTube Music

Security checks across malware telemetry and agentic risk

Overview

This is a straightforward YouTube Music helper, but it requires local YouTube Music authentication files that should be treated like credentials.

Install only if you are comfortable letting the agent access and change your YouTube Music library and playlists. Keep `browser.json` private, delete `headers.txt` after setup, do not commit either file to source control, and ask the agent to confirm before making playlist or library changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs users to copy a full authenticated YouTube Music request as cURL and save it to a local file, then derive a persistent auth file from it, without warning that these materials may contain highly sensitive session headers, cookies, or account tokens. In an agent-skill context, this is dangerous because users may unknowingly expose reusable credentials in the skill directory, logs, backups, or source control, enabling unauthorized access to their YouTube/Google account data.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal