YouTube Activity

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:20 PM UTC
• Version: 0.10.7-dev

Overview

The skill is coherent for listing YouTube activity, but it asks users to install an unpinned third-party CLI that will handle YouTube OAuth credentials and cached tokens.

Review the yutu package/source before installing, prefer a pinned and verified release, avoid elevated/global installation when practical, store client_secret.json and youtube.token.json outside repositories with restrictive permissions, and revoke/rotate the Google OAuth token if those files may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-21; references/setup.md:31-55
Vulnerability Type: Unpinned and unverifiable third-party executable dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:17-21:

yaml

homepage: https://github.com/eat-pray-ai/yutu
install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

references/setup.md:31-55:

markdown

## Installation

Install `yutu` using one of these methods:


```bash
# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

Other platforms

Download a prebuilt binary from the releases page and place it in your PATH.

text

### Technical Analysis

The skill installs and invokes the third-party `yutu` executable without pinning an immutable version or requiring checksum or signature verification. The Node.js package has no explicit version, the Go command explicitly uses `@latest`, package-manager commands rely on mutable repository state, and the binary download points to the mutable `releases/latest` endpoint.

Consequently, the executable installed by a user can differ from the artifact that was available when the skill was audited. A compromise of the upstream source repository, package registry account, package-manager formula or manifest, release pipeline, or publisher credentials could cause a malicious version to be installed without any modification to this skill package.

The dependency is especially sensitive because it is expected to process Google OAuth client credentials and cached OAuth tokens. The setup guide identifies `client_secret.json`, `youtube.token.json`, `YUTU_CREDENTIAL`, and `YUTU_CACHE_TOKEN` as credential sources. An attacker-controlled release could therefore read and transmit those secrets in addition to executing arbitrary act
...[truncated 1734 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @eat-pray-ai/yutu to a specifically reviewed version rather than allowing the package manager to resolve the current release.
2. Replace github.com/eat-pray-ai/yutu@latest with an immutable, reviewed version or commit.
3. Link binary downloads to a specific release rather than releases/latest.
4. Publish SHA-256 or stronger checksums for every supported binary and instruct users to verify them before execution.
5. Prefer cryptographically signed releases and document signature verification using a trusted publisher key.
6. Identify the expected package publisher and official package-manager repository so users can detect package substitution or similarly named packages.
7. Review new dependency versions before updating the pinned release, including installation scripts, transitive dependencies, and release provenance.
8. Recommend installation in an isolated, least-privileged environment instead of an elevated global context where practical.
9. Document the minimum OAuth scopes required for activity listing and discourage granting broader YouTube permissions.
10. Require restrictive filesystem permissions for client_secret.json and youtube.token.json, and advise users not to expose credential JSON through shell history, logs, or broadly inherited environment variables.
11. Provide token revocation and rotation instructions for users who suspect that an installed CLI release was compromised.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to save OAuth client secrets and cached access tokens locally in predictable filenames, but provides no warning about treating these files as sensitive, restricting permissions, or avoiding accidental inclusion in source control. While local storage of OAuth material is common, omitting basic handling guidance increases the chance of credential leakage and unauthorized access to the user's YouTube account or API project.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.