ClawHub
Back to skill

Security audit

YouTube API CLI

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a straightforward YouTube CLI guide, but its install instructions use an unpinned external executable path with optional system-wide sudo installation, which users should review carefully.

Review the upstream CLI before installing, prefer a pinned version with verified checksums or signatures, and avoid the sudo /usr/local/bin path if a user-local install works. Use least-privilege Google credentials, test with a noncritical channel or private/unlisted targets first, and confirm before running upload, playlist, or channel update commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:14
Finding

Installation of Unpinned and Unverified External Executables

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 14–20
Vulnerability Type: Mutable and unverified third-party dependency installation
Risk Level: High

bash
# Using go install
go install github.com/nerveband/youtube-api-cli/cmd/yt-api@latest

# Or download from releases
curl -L -o yt-api https://github.com/nerveband/youtube-api-cli/releases/latest/download/yt-api-darwin-arm64
chmod +x yt-api
sudo mv yt-api /usr/local/bin/

Technical Analysis

Both documented installation methods retrieve mutable latest artifacts from an external repository. Neither method pins an immutable release version or commit, and the downloaded executable is not validated using a cryptographic checksum or signature before being made executable.

The direct-download method uses curl -L, which follows redirects, and then installs the resulting file into /usr/local/bin/ with elevated privileges. Consequently, the code ultimately executed by users can change after the Skill has been reviewed without any corresponding modification to SKILL.md.

The Go installation method has a similar supply-chain weakness because @latest resolves dynamically. A compromise of the upstream repository, maintainer account, module release process, or build pipeline could cause users to install attacker-controlled code.

Attack Path

  1. An attacker compromises the upstream repository, maintainer account, release workflow, module publication process, or downloadable release artifact.
  2. The attacker publishes a malicious version that becomes the target of @latest or replaces the asset referenced through /releases/latest/.
  3. A user follows the documented installation instructions.
  4. The malicious artifact is downloaded without integrity or authenticity verification.
  5. The artifact is made executable and, in the binary-download workflow, placed in /usr/local/bin/ using sudo.
  6. The user runs yt-api to authenticate or ...[truncated 1105 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest and /releases/latest/ with a reviewed, explicitly pinned release version or immutable commit.
  2. Publish SHA-256 checksums through a separately protected release process and verify the downloaded artifact before granting execute permissions.
  3. Prefer cryptographic release signatures or provenance attestations, and document signature verification using a pinned maintainer identity.
  4. Use curl --fail --show-error --location and validate the final artifact, but do not treat HTTPS or successful download status as a substitute for integrity verification.
  5. Avoid installing with sudo where possible. Install into a user-controlled directory such as ~/.local/bin and apply least privilege.
  6. Consider building the pinned release from reviewed source in a controlled environment.
  7. Document expected release hashes and supported architectures directly in versioned installation instructions.
  8. Protect OAuth tokens and service-account credentials from the installed process where possible, grant only necessary API scopes, and rotate credentials immediately if an installed artifact fails verification.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 20)May include surrounding context.

Or download from releases

curl -L -o yt-api https://github.com/nerveband/youtube-api-cli/releases/latest/download/yt-api-darwin-arm64 chmod +x yt-api sudo mv yt-api /usr/local/bin/

text

## Setup

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
1. Go to [Google Cloud Console](https://console.cloud.google.com)
2. Create/enable YouTube Data API v3
3. Create OAuth 2.0 credentials (Desktop app)
4. Download client configuration

### 2. Configure yt-api

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill documents live account-modifying operations such as uploads, playlist creation, playlist-item insertion, and channel updates without prominent warnings that these commands affect a real YouTube account. In an agent/automation context, this increases the chance of unintended state changes, accidental publishing, or destructive edits being performed against production data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.