YouTube Caption

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:42 PM UTC
• Version: 0.10.7-dev

Overview

This skill is a straightforward YouTube caption management wrapper, but users should treat its OAuth files and destructive caption commands carefully.

Install this only if you trust the yutu CLI source. Keep client_secret.json and youtube.token.json out of repositories and shared folders, restrict their permissions, and verify caption IDs before running update or delete commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:18
• Finding: Unpinned Third-Party CLI Installation Creates Supply-Chain Risk## Vulnerability Details **File Locations**: `SKILL.md:18-21` and `references/setup.md:32-54` **Vulnerability Type**: Unpinned and unverifiable third-party executable dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:18-21` ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:32-54` ```markdown Install `yutu` using one of these methods: ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ### Other platforms Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH. ``` ### Technical Analysis The Skill installs and executes the third-party `yutu` CLI without pinning a reviewed version. The npm, Homebrew, Winget, and release-page instructions implicitly resolve a mutable current release, while the Go command explicitly requests `@latest`. No checksum, signature, lockfile, commit identifier, or package-provenance verification is supplied. This CLI is security-sensitive because it is configured to access Google OAuth client credentials and a cached YouTube authorization token. A compromised publisher account, package registry entry, package-manager manifest, source repository, or binary release could therefore distribute an altered executable under the expected package name. There is no evidence that the currently named package or repository is malicious; the risk arises from installing future mutable artifacts without integrity controls. ### Attack Path 1. An attacker compromises a supported distribution channel, publisher account, repository, or release artifact. 2. The attacker publishes a malicious version under the legitimate `yutu` package or release identity. 3. A user follows the doc ...[truncated 1120 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm dependency to a specific reviewed version rather than resolving the current release implicitly. 2. Replace `github.com/eat-pray-ai/yutu@latest` with a fixed semantic version or reviewed commit hash. 3. Link to a specific release instead of the mutable `/releases/latest` endpoint. 4. Publish SHA-256 checksums for prebuilt binaries and document an explicit verification command before installation. 5. Prefer signed release artifacts and verify signatures against a documented maintainer key. 6. Pin package-manager manifests where supported and document the exact expected package publisher and repository. 7. Use automated dependency monitoring to review security advisories before updating the pinned version. 8. Recommend least-privilege Google OAuth scopes and restrict credential and token files to the owning user. 9. Avoid privileged installation where possible, and run the CLI as a non-administrative user.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: This markdown file documents a delete operation for YouTube captions, which can affect user data, but it provides no explicit warning that deletion may be destructive or irreversible. Under the markdown-specific warning criteria, skills should disclose behaviours that could affect user data or system integrity.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: This markdown file describes a deletion command and provides examples for removing captions, but it does not include any warning about the destructive or potentially irreversible nature of the action. For markdown files, operations that can affect user data or system integrity should include an explicit warning so users understand the impact before running the command.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The setup guide instructs users to download OAuth client credentials and cache OAuth tokens locally as `client_secret.json` and `youtube.token.json` without any warning to protect, restrict permissions on, or avoid committing these sensitive files. While local storage of OAuth material is common, omitting basic handling guidance increases the risk of accidental disclosure through source control, shared directories, backups, or multi-user systems.

Static analysis

No suspicious patterns detected.