T09 · Insecure Skill Coding Practices
Error
- Location
scripts/helper.py:184- Finding
Reusable YouTube Session Credentials Are Collected Through Chat and Command-Line Arguments
- Content
View full analysis
Network Filter /browse and reload the page Open any matching request Copy the Cookie request header value Send the full Cookie string back to me ``` ```bash uv run --with ytmusicapi python scripts/helper.py auth setup --cookie '' uv run --with ytmusicapi python scripts/helper.py auth setup --cookies-file /path/to/cookies.json ``` ```python elif args.action == "setup": if getattr(args, "cookies_file", None): _import_cookies_json(args.cookies_file) else: cookie = args.cookie or sys.stdin.read().strip() if not cookie: bail("No cookie provided. Pass --cookie '' or --cookies-file cookies.json") headers = build_auth_from_cookie(cookie) _write_json(AUTH_FILE, headers) out({"status": "saved", "path": str(AUTH_FILE)}) ``` ```python pa.add_argument("--cookie", help="Raw Cookie header string (for setup)") pa.add_argument("--cookies-file", dest="cookies_file", help="JSON cookie export from a browser extension (for setup, e.g. Cookie-Editor)") ``` ### Technical Analysis A complete authenticated Google/YouTube `Cookie` header is a reusable session credential. The Skill explicitly instructs the user to send this credential to the agent and supports supplying it through the `--cookie` command-line option. Credentials submitted through an agent conversation may be retained in ...[truncated 1635 chars]- Remediation
View remediation