Security audit

TinkerClaw YouTube

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed YouTube utility that uses read-only Google OAuth only for account-linked YouTube data and gives users controls to avoid or remove that access.

Install only if you are comfortable with a local CLI reading YouTube data through your own Google OAuth client and storing a read-only token on disk. Use a dedicated Google OAuth client, avoid relying on the gogcli fallback if you want clearer separation, set YOUTUBE_SKILL_NO_ACCOUNT=1 for transcript/download-only use, and run logout plus revoke the grant in your Google account when finished.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Rogue AgentSelf-Modification, Session Persistence
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: The README states that this skill may reuse ~/.config/gogcli/credentials.json from a sibling tool as a fallback OAuth client. Cross-tool credential fallback broadens the trust boundary and can cause users to authenticate this skill with secrets provisioned for another application, increasing the chance of unintended credential exposure or misuse if either tool is compromised or differently governed.
Content: Scanner excerpt · README.md (reported line 252)May include surrounding context.
md
The skill writes `token.json` at `0600` itself and never puts it anywhere but this directory. If you already configured the sibling `gogcli` Google skill, its `~/.config/gogcli/credentials.json` is used as a fallback client — so authenticating here may reuse credentials you set up for that skill. Never commit either file, and prefer a dedicated Google project so a leaked client is cheap to revoke.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The description is broadly aligned with the code's core purpose: YouTube transcripts, downloads, exploration, and optional read-only OAuth access using the user's own client with local token storage and logout. The code also includes explicit consent before storing tokens, read-only scope only, and account off-switches, which support the stated privacy/consent framing. However, there are material description/behavior gaps. The code exposes additional user/account and content-access features not mentioned in the declared purpose, including comments retrieval, channel info lookup, and several authenticated account-data commands (subscriptions, playlists, playlist items, liked videos). Also, the description specifically promises '4K downloads,' but the implemented CLI only offers named resolution presets up to 1080p plus 'best'; while 'best' may sometimes yield 4K, that is not an explicit 4K mode. So the description does not fully or precisely represent the actual capabilities.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill reads OAuth client credentials from user config locations and stores OAuth tokens on disk, which is sensitive credential handling even if intended functionality requires it. If the agent or another local process is compromised, these files can expose reusable authentication material for the user's YouTube/Google account access.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
- offline license: MIT notes: security: "Two halves, and they have different permission profiles. (1) TRANSCRIPTS AND DOWNLOADS: no account, no API key, no quota — youtube-transcript-api prints to stdout and writes nothing; downloads shell out to your installed yt-dlp (argv list, never shell=true) and write media to the folder you name, or the current directory if you name none. (2) SEARCH, VIDEO/CHANNEL/COMMENT DETAILS AND YOUR OWN SUBSCRIPTIONS, PLAYLISTS AND LIKED VIDEOS: these call YouTube Data API v3 and DO require Google OAuth, using an OAuth client YOU create. Since 4.3.0 the only scope requested is youtube.readonly — the skill cannot post, rate, subscribe or modify anything. The resulting token is stored as JSON at ~/.config/youtube-skill/token.json, mode 0600 (a pre-4.3.0 token.pickle is never read; sign in again, and `logout` deletes it), only after an explicit y/N consent prompt naming the path and the scope. It also reads an existing OAuth client from ~/.config/gogcli/credentials.json if present. Nothing is sent anywhere except youtube.com and googleapis.com. Off-switches: YOUTUBE_SKILL_NO_ACCOUNT=1 disables every sign-in path, YOUTUBE_SKILL_NO_DOWNLOAD=1 disables downloads, and `logout` deletes the stored token. See the Permissions, Data Flow & Consent section." --- # YouTube Ultimate

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: This section confirms credential read/write behavior and token persistence, which creates a real attack surface around sensitive local authentication artifacts. Even with read-only OAuth scope, stolen refresh/access tokens can enable ongoing access to account-linked YouTube data and may persist beyond a single session.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists | | Credential read | Finds the OAuth **client** you created | `~/.config/youtube-skill/credentials.json`, falling back to `~/.config/gogcli/credentials.json` if you already set up the sibling Google skill | | Credential write | Stores the resulting token so you sign in once | one JSON file, `0600`, path named in the prompt before it is written | | Subprocess exec | Downloads are delegated to `yt-dlp` | one binary found via `PATH`, invoked as an **argv list — never `shell=True`**, arguments limited to a YouTube URL, a format string from a fixed table, and your `-o` directory | | File write | Media and subtit ...[truncated 25 chars]

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 240)May include surrounding context.
md
CONFIG_DIR = Path.home() / '.config' / 'youtube-skill' CREDENTIAL_PATHS = [ Path.home() / '.config' / 'youtube-skill' / 'credentials.json', Path.home() / '.config' / 'gogcli' / 'credentials.json', ] DEFAULT_ACCOUNT = 'default'

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 242)May include surrounding context.
md
CONFIG_DIR = Path.home() / '.config' / 'youtube-skill' CREDENTIAL_PATHS = [ Path.home() / '.config' / 'youtube-skill' / 'credentials.json', Path.home() / '.config' / 'gogcli' / 'credentials.json', ] DEFAULT_ACCOUNT = 'default'

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · README.md (reported line 247)May include surrounding context.
md
CONFIG_DIR = Path.home() / '.config' / 'youtube-skill' CREDENTIAL_PATHS = [ Path.home() / '.config' / 'youtube-skill' / 'credentials.json', Path.home() / '.config' / 'gogcli' / 'credentials.json', ] DEFAULT_ACCOUNT = 'default'

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/youtube.py (reported line 90)May include surrounding context.
python
CONFIG_DIR = Path.home() / '.config' / 'youtube-skill' CREDENTIAL_PATHS = [ Path.home() / '.config' / 'youtube-skill' / 'credentials.json', Path.home() / '.config' / 'gogcli' / 'credentials.json', ] DEFAULT_ACCOUNT = 'default'

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/youtube.py (reported line 91)May include surrounding context.
python
CONFIG_DIR = Path.home() / '.config' / 'youtube-skill' CREDENTIAL_PATHS = [ Path.home() / '.config' / 'youtube-skill' / 'credentials.json', Path.home() / '.config' / 'gogcli' / 'credentials.json', ] DEFAULT_ACCOUNT = 'default'

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/youtube.py (reported line 195)May include surrounding context.
python
CONFIG_DIR = Path.home() / '.config' / 'youtube-skill' CREDENTIAL_PATHS = [ Path.home() / '.config' / 'youtube-skill' / 'credentials.json', Path.home() / '.config' / 'gogcli' / 'credentials.json', ] DEFAULT_ACCOUNT = 'default'

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · scripts/youtube.py (reported line 201)May include surrounding context.
python
CONFIG_DIR = Path.home() / '.config' / 'youtube-skill' CREDENTIAL_PATHS = [ Path.home() / '.config' / 'youtube-skill' / 'credentials.json', Path.home() / '.config' / 'gogcli' / 'credentials.json', ] DEFAULT_ACCOUNT = 'default'

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 45)May include surrounding context.
md
**Scope: `youtube.readonly`, and nothing else.** Since 4.3.0 this skill requests a single read-only scope. It cannot post a comment, rate a video, subscribe, or touch a playlist even if it wanted to. (Versions ≤4.2.3 requested read-write `youtube` and `youtube.force-ssl` — if you authenticated back then, run `logout` and `auth` again to downgrade the grant.) **Where the token lives.** `~/.config/youtube-skill/token.json`, written mode `0600` inside a

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 237)May include surrounding context.
md
work with nothing configured — skip to using them if that is all you want. 1. Go to [Google Cloud Console](https://console.cloud.google.com/apis/credentials) 2. Create a project (or select existing) 3. Enable "YouTube Data API v3" 4. Create OAuth 2.0 Client ID (Desktop app) 5. Download JSON → save as `~/.config/youtube-skill/credentials.json`

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 246)May include surrounding context.
live grant on your account. Lock them down and keep them out of version control:

bash
mkdir -p ~/.config/youtube-skill && chmod 700 ~/.config/youtube-skill chmod 600 ~/.config/youtube-skill/credentials.json

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 80% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · README.md (reported line 247)May include surrounding context.
bash
mkdir -p ~/.config/youtube-skill && chmod 700 ~/.config/youtube-skill chmod 600 ~/.config/youtube-skill/credentials.json

The skill writes token.json at 0600 itself and never puts it anywhere but this directory.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill advertises and documents capabilities including network access, reading credentials, writing tokens/files, and invoking an external downloader, but the manifest does not declare a corresponding tool scope or permissions block. In an agent ecosystem, undeclared capabilities are dangerous because they prevent operators and policy engines from accurately gating what the skill can do, increasing the chance of silent over-privilege.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 83% confidence
Finding: The skill intentionally persists session material by storing an OAuth token on disk and also writes downloaded media to user-selected or current directories. Persistent authentication artifacts increase risk because compromise of the local environment can yield long-lived access without re-consent, especially if refresh tokens are stored.
Content: Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.
md
- offline license: MIT notes: security: "Two halves, and they have different permission profiles. (1) TRANSCRIPTS AND DOWNLOADS: no account, no API key, no quota — youtube-transcript-api prints to stdout and writes nothing; downloads shell out to your installed yt-dlp (argv list, never shell=true) and write media to the folder you name, or the current directory if you name none. (2) SEARCH, VIDEO/CHANNEL/COMMENT DETAILS AND YOUR OWN SUBSCRIPTIONS, PLAYLISTS AND LIKED VIDEOS: these call YouTube Data API v3 and DO require Google OAuth, using an OAuth client YOU create. Since 4.3.0 the only scope requested is youtube.readonly — the skill cannot post, rate, subscribe or modify anything. The resulting token is stored as JSON at ~/.config/youtube-skill/token.json, mode 0600 (a pre-4.3.0 token.pickle is never read; sign in again, and `logout` deletes it), only after an explicit y/N consent prompt naming the path and the scope. It also reads an existing OAuth client from ~/.config/gogcli/credentials.json if present. Nothing is sent anywhere except youtube.com and googleapis.com. Off-switches: YOUTUBE_SKILL_NO_ACCOUNT=1 disables every sign-in path, YOUTUBE_SKILL_NO_DOWNLOAD=1 disables downloads, and `logout` deletes the stored token. See the Permissions, Data Flow & Consent section." --- # YouTube Ultimate

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
**What it needs, and why.** | Capability | Why | Scope | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 85)May include surrounding context.
md
**What it needs, and why.** | Capability | Why | Scope | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
md
| Capability | Why | Scope | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists | | Credential read | Finds the OAuth **client** you created | `~/.config/youtube-skill/credentials.json`, falling back to `~/.config/gogcli/credentials.json` if you already set up the sibling Google skill | | Credential write | Stores the resulting token so you sign in once | one JSON file, `0600`, path named in the prompt before it is written |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 88)May include surrounding context.
md
| Capability | Why | Scope | | ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists | | Credential read | Finds the OAuth **client** you created | `~/.config/youtube-skill/credentials.json`, falling back to `~/.config/gogcli/credentials.json` if you already set up the sibling Google skill | | Credential write | Stores the resulting token so you sign in once | one JSON file, `0600`, path named in the prompt before it is written | | Subprocess exec | Downloads are de ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 89)May include surrounding context.
md
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists | | Credential read | Finds the OAuth **client** you created | `~/.config/youtube-skill/credentials.json`, falling back to `~/.config/gogcli/credentials.json` if you already set up the sibling Google skill | | Credential write | Stores the resulting token so you sign in once | one JSON file, `0600`, path named in the prompt before it is written | | Subprocess exec | Downloads are delegated to `yt-dlp` | one binary found via `PATH`, invoked as an **argv list — never `shell=True`**, arguments limited to a YouTube URL, a format string from a fixed table, and your `-o` directory | | File write | Media and subtit ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
| Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists | | Credential read | Finds the OAuth **client** you created | `~/.config/youtube-skill/credentials.json`, falling back to `~/.config/gogcli/credentials.json` if you already set up the sibling Google skill | | Credential write | Stores the resulting token so you sign in once | one JSON file, `0600`, path named in the prompt before it is written | | Subprocess exec | Downloads are delegated to `yt-dlp` | one binary found via `PATH`, invoked as an **argv list — never `shell=True`**, arguments limited to a YouTube URL, a format string from a fixed table, and your `-o` directory | | File write | Media and subtitles from downloads | the directory you choose, or the current directory | | Account data read | `subscriptions`, ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 90)May include surrounding context.
md
| Network | Fetch transcripts, call the Data API, download media | `youtube.com` and `googleapis.com` only | | Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists | | Credential read | Finds the OAuth **client** you created | `~/.config/youtube-skill/credentials.json`, falling back to `~/.config/gogcli/credentials.json` if you already set up the sibling Google skill | | Credential write | Stores the resulting token so you sign in once | one JSON file, `0600`, path named in the prompt before it is written | | Subprocess exec | Downloads are delegated to `yt-dlp` | one binary found via `PATH`, invoked as an **argv list — never `shell=True`**, arguments limited to a YouTube URL, a format string from a fixed table, and your `-o` directory | | File write | Media and subtitles from downloads | the directory you choose, or the current directory | | Account data read | `subscriptions`, ...[truncated 25 chars]

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · SKILL.md (reported line 91)May include surrounding context.
md
| Google OAuth | Search, comments, video/channel details, and your own subscriptions/playlists/liked videos have no unauthenticated equivalent | **`youtube.readonly` only** — cannot post comments, rate, subscribe, or modify playlists | | Credential read | Finds the OAuth **client** you created | `~/.config/youtube-skill/credentials.json`, falling back to `~/.config/gogcli/credentials.json` if you already set up the sibling Google skill | | Credential write | Stores the resulting token so you sign in once | one JSON file, `0600`, path named in the prompt before it is written | | Subprocess exec | Downloads are delegated to `yt-dlp` | one binary found via `PATH`, invoked as an **argv list — never `shell=True`**, arguments limited to a YouTube URL, a format string from a fixed table, and your `-o` directory | | File write | Media and subtitles from downloads | the directory you choose, or the current directory | | Account data read | `subscriptions`, `playlists`, `liked`, `channel` are the point of those commands | read-only, on demand, never fetched by the other commands |

Static analysis

No suspicious patterns detected.