YouTube Channel

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:01 AM UTC
• Version: 0.10.7-dev

Overview

This skill is a coherent YouTube channel management helper, but users should treat its OAuth files and channel update commands carefully.

Install only if you trust the yutu CLI source, prefer a pinned or verified release, and keep client_secret.json and youtube.token.json private and out of source control. Confirm the channel ID and requested fields before using channel update because it can change live public channel metadata.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party CLI Installation from Mutable Sources

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-21; references/setup.md:35-54
Vulnerability Type: Unpinned and unverifiable third-party executable dependency
Risk Level: Medium

The skill declares and recommends installation of the third-party yutu CLI without pinning an audited version or requiring artifact integrity verification.

Relevant code from SKILL.md:17-21:

yaml

homepage: https://github.com/eat-pray-ai/yutu
install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

Relevant code from references/setup.md:35-54:

bash

```bash
# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

Other platforms

Download a prebuilt binary from the releases page and place it in your PATH.

text

### Technical Analysis

The npm package declaration has no version constraint, and the setup guide explicitly uses `@latest` and the mutable `releases/latest` endpoint. No checksum, digital signature, immutable commit, lockfile, or other integrity control is specified.

Consequently, the executable installed by a user can differ from the version that existed when the skill was audited. The global npm command also installs package-controlled executable content in the user's environment. Package-manager formulae and release downloads similarly depend on mutable external repositories and their current state.

This is a supply-chain weakness rather than evidence that the current `yutu` package is malicious. The documented GitHub organization and npm scope are consistent, and the reviewed files contain no direct evidence of typosquatting or intentional malicious behavior.

### Attack Path

1. An attacker compromises the upstream maintainer account, package re
...[truncated 1454 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @eat-pray-ai/yutu to a specific audited version rather than allowing automatic resolution to the newest release.
2. Replace go install github.com/eat-pray-ai/yutu@latest with a fixed semantic version or immutable commit hash.
3. Replace releases/latest with a version-specific release URL.
4. Publish SHA-256 checksums for downloaded binaries and require users to verify them before execution.
5. Prefer signed releases and document signature verification using a trusted maintainer key or a provenance framework such as Sigstore.
6. Pin package-manager formula versions where supported and document the expected package source.
7. Avoid global npm installation where practical; use a project-local, locked dependency or an isolated execution environment.
8. Record the audited dependency version and periodically review it before updating.
9. Restrict OAuth scopes to the minimum necessary and protect credential and token files with least-privilege filesystem permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 90% confidence

Finding

The guide documents an authentication flow that stores a reusable OAuth token in youtube.token.json without any warning about safeguarding that token. Cached OAuth tokens can often be reused by anyone who obtains them, making this dangerous in a skill whose purpose includes updating channel information.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

3. Authenticate:

   bash

   yutu auth --credential client_secret.json
   

   A browser window will open for you to grant YouTube access. After granting permission, a token is saved to youtube.token.json.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The environment variable table explicitly states that OAuth client secrets and cached tokens may be supplied as 'Path, base64, or JSON', which encourages handling secrets in forms that are easy to leak through shell history, process listings, logs, CI output, or configuration files. In the context of a channel-management skill, leakage of these values could expose privileged YouTube account access.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

| Variable | Description | Default |
|----------|-------------|---------|
| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest description embeds trigger phrases such as "list channel" and especially "update channel"/"update my channel" without clarifying invocation scope, exclusions, or negative examples. These phrases are generic enough to overlap with ordinary user requests about YouTube channels, which can cause unintended activation in contexts beyond this specific CLI skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This documentation describes a command that updates live YouTube channel metadata but does not clearly warn users that it performs a real, state-changing operation against a production channel. In an agent or automation context, that omission can lead to unintended modifications of public-facing channel title, description, URL, language, or country, especially if a user interprets it as informational rather than destructive or mutating.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to create and store OAuth client credentials and cached access tokens on disk, but it does not warn that these files are sensitive secrets that can grant access to the user's YouTube account and should be protected from disclosure. In a skill that manages YouTube channels, those tokens are especially sensitive because compromise could enable unauthorized channel reads or updates.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.