YouTube Channel Banner

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 10:44 PM UTC
• Version: 0.10.7-dev

Overview

This skill is a straightforward YouTube banner uploader, but users should protect their OAuth files and be careful about the third-party CLI they install.

Install yutu only from a source you trust, prefer a pinned reviewed version if available, and keep client_secret.json and youtube.token.json out of source control and shared folders. Review the OAuth consent screen carefully, grant only the access needed for banner uploads, and understand that running the insert command will modify the selected YouTube channel banner.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:36

Finding

Unpinned Third-Party CLI Installation Creates Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: references/setup.md:36-51; related dependency declaration at SKILL.md:18-21
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:18-21:

yaml

install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

references/setup.md:36-51:

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

markdown

### Other platforms

Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH.

Technical Analysis

The Skill instructs users to install and execute the yutu CLI without pinning a reviewed version or verifying an artifact checksum or signature. The Go command explicitly uses the mutable @latest selector, while the npm, Homebrew, Winget, and GitHub release instructions similarly resolve packages or binaries that may change after this Skill has been audited.

The external CLI is security-sensitive because the documented workflow gives it access to:

• The OAuth client credential stored in client_secret.json or supplied through YUTU_CREDENTIAL.
• The cached OAuth token stored in youtube.token.json or supplied through YUTU_CACHE_TOKEN.
• Local banner image files.
• YouTube operations authorized by the OAuth scopes granted by the user.

Consequently, the behavior actually executed by users is not fully represented by the reviewed project. A compromised package publisher, package registry entry, distribution repository, or release artifact could substitute malicious CLI code.

Attack Path

1. An attacker compromises a supported distribution channel, publisher account, upstream repository, package release, or mutab ...[truncated 1343 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin a specific reviewed yutu version in every installation method instead of using unversioned packages or @latest.
2. For Go installations, replace @latest with an immutable, reviewed release tag.
3. Publish SHA-256 checksums and, preferably, cryptographic signatures for downloadable binaries. Require users to verify them before execution.
4. Document the authoritative npm publisher, Homebrew tap, Winget source, Go module, and GitHub repository to reduce package substitution and namespace ambiguity.
5. Prefer project-local or isolated installation over global installation where supported.
6. Use lockfiles or integrity metadata where the package manager supports them.
7. Document the minimum OAuth scopes required for banner uploads and advise users to reject broader permissions.
8. Require restrictive filesystem permissions for client_secret.json and youtube.token.json, and advise users not to place these files in source control.
9. Establish a release-review process that verifies source provenance, build reproducibility, package signatures, and checksums before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The setup guide instructs users to download OAuth client credentials and store both the client secret and resulting OAuth token locally, but it does not warn that these files are sensitive or provide guidance on protecting them. If these files are left in a project directory, committed to source control, or exposed through logs or backups, an attacker could reuse them to access the user's YouTube account via the API.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.