YouTube Channel Section

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:44 PM UTC
• Version: 0.10.7-dev

Overview

This skill does what it says, but it asks for YouTube account credentials and can delete channel sections without enough safety guidance.

Review before installing. Use a pinned and verified yutu version where possible, keep client_secret.json and youtube.token.json out of shared folders and source control, prefer protected secret storage over raw JSON in environment variables, and require explicit confirmation before any delete command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:38

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

The guide states that an OAuth token is saved to youtube.token.json after authentication, but it does not explain that this cached token is a sensitive bearer credential. Anyone who obtains the token file may be able to act as the user against permitted YouTube APIs until the token is revoked or expires and is refreshed.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

3. Authenticate:

   bash

   yutu auth --credential client_secret.json
   

   A browser window will open for you to grant YouTube access. After granting permission, a token is saved to youtube.token.json.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The environment variable documentation allows OAuth secrets and cached tokens to be supplied as path, base64, or raw JSON, which increases the chance that credentials are exposed through shell history, process listings, CI logs, or copied configuration files. In a skill context where users may follow setup instructions quickly, this expands the attack surface for credential leakage.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

| Variable | Description | Default |
|----------|-------------|---------|
| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill explicitly supports deleting YouTube channel sections but does not provide any warning that the operation is destructive, irreversible, or should be confirmed before execution. In an agent-driven context, this omission increases the chance of accidental destructive actions by users or automated workflows that interpret the skill as routine and safe to run.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to store OAuth client secrets and cached access tokens as local files but does not warn that these files are sensitive or recommend secure storage and file-permission controls. If those files are left in a shared directory, committed to source control, or exposed through logs/backups, an attacker could reuse them to access the user's YouTube account or API project.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.