YouTube Channel Section

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:44 PM UTC
• Version: 0.10.7-dev

Overview

This skill does what it says, but it asks for YouTube account credentials and can delete channel sections without enough safety guidance.

Review before installing. Use a pinned and verified yutu version where possible, keep client_secret.json and youtube.token.json out of shared folders and source control, prefer protected secret storage over raw JSON in environment variables, and require explicit confirmation before any delete command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:38
• Finding: Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk< and place it in your PATH. ``` Related metadata in `SKILL.md:15-19`: ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` ### Technical Analysis The Skill instructs users or agents to install and execute a third-party CLI without pinning an audited version or requiring artifact-integrity verification. The npm command resolves the package manager's current default version, the Go command explicitly uses `@latest`, and the GitHub URL points to the mutable `latest` release. The package-manager instructions also do not specify checksums, signatures, lockfiles, or immutable release identifiers. Consequently, the executable installed when the Skill is used may differ from the version that existed when the Skill documentation was reviewed. A compromise of the upstream publisher account, source repository, release pipeline, registry entry, or package-manager distribution could substitute malicious executable code. There is no evidence in the audited files that the named project is malicious, typosquatted, or currently compromised. The issue is the absence of dependency pinning and integrity controls. ### Attack Path 1. An attacker compromises an upstream publisher account, repository, package registry, release workflow, or package-manager entry associated with `yutu`. 2. The attacker publishes a malicious version or replaces the ...[truncated 1328 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every installation method to a specific audited version rather than relying on package-manager defaults, `@latest`, or a mutable `latest` release URL. 2. Publish SHA-256 or stronger cryptographic checksums for prebuilt binaries and require users to verify them before execution. 3. Sign release artifacts and document signature verification using a maintained signing mechanism such as Sigstore or platform-native package signing. 4. Use immutable release URLs and commit or tag references whose contents cannot be silently replaced. 5. Record the expected package name, version, source repository, and integrity digest in the Skill metadata. 6. Prefer a project-local, version-locked installation over a global installation where supported. 7. Document the minimum OAuth scopes required by the supported operations and advise users not to grant broader permissions. 8. Recommend restrictive filesystem permissions for `client_secret.json` and `youtube.token.json`, along with token revocation and rotation procedures for suspected dependency compromise. 9. Add a release-review process that re-audits the pinned CLI version before updating the version or integrity digest referenced by the Skill. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

3. **Authenticate**:

   ```bash
   yutu auth --credential client_secret.json
   ```

   A browser window will open for you to grant YouTube access. After granting permission, a token is saved to `youtube.token.json`.

• Confidence: 84% confidence
• Finding: The guide states that an OAuth token is saved to `youtube.token.json` after authentication, but it does not explain that this cached token is a sensitive bearer credential. Anyone who obtains the token file may be able to act as the user against permitted YouTube APIs until the token is revoked or expires and is refreshed.

Credential Access

High

• Category: Privilege Escalation

Content

| Variable | Description | Default |
|----------|-------------|---------|
| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

• Confidence: 87% confidence
• Finding: The environment variable documentation allows OAuth secrets and cached tokens to be supplied as path, base64, or raw JSON, which increases the chance that credentials are exposed through shell history, process listings, CI logs, or copied configuration files. In a skill context where users may follow setup instructions quickly, this expands the attack surface for credential leakage.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill explicitly supports deleting YouTube channel sections but does not provide any warning that the operation is destructive, irreversible, or should be confirmed before execution. In an agent-driven context, this omission increases the chance of accidental destructive actions by users or automated workflows that interpret the skill as routine and safe to run.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guide instructs users to store OAuth client secrets and cached access tokens as local files but does not warn that these files are sensitive or recommend secure storage and file-permission controls. If those files are left in a shared directory, committed to source control, or exposed through logs/backups, an attacker could reuse them to access the user's YouTube account or API project.

Static analysis

No suspicious patterns detected.