ClawHub
Back to skill

Security audit

YouTube Comment

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its YouTube comment-management purpose, but it should be reviewed because it installs an unpinned third-party CLI that uses OAuth credentials and can delete or moderate public comments without clear safety guidance.

Install only if you are comfortable trusting the yutu CLI with your Google/YouTube OAuth token and with the ability to create, delete, reject, mark spam, and ban authors on your account. Prefer a pinned, verified yutu version, keep client_secret.json and youtube.token.json out of repositories and shared workspaces, restrict token/file access, and manually review comment IDs before deletion or moderation commands.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
references/setup.md:30
Finding

Unpinned Third-Party CLI Installation Without Integrity Verification

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:17-25, references/setup.md:30-54
Vulnerability Type: Unpinned and unverified third-party executable dependency
Risk Level: High

Vulnerable Code

SKILL.md:17-25:

yaml
    homepage: https://github.com/eat-pray-ai/yutu
    install:
      - kind: node
        package: "@eat-pray-ai/yutu"
        bins: [yutu]

references/setup.md:30-54:

markdown
## Installation

Install `yutu` using one of these methods:


```bash
# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

Other platforms

Download a prebuilt binary from the releases page and place it in your PATH.

text

### Technical Analysis

The skill directs users to install and execute the third-party `yutu` CLI without pinning an audited version. The Go command explicitly selects `@latest`, the release link resolves to the mutable latest release, and the npm, Homebrew, and Winget instructions similarly omit version constraints. No checksum, cryptographic signature, provenance attestation, or other integrity-verification procedure is documented.

This creates a supply-chain trust boundary in which the code reviewed as part of this skill does not determine the code ultimately executed. A compromised publisher account, package registry, source repository, release pipeline, package-manager formula, or upstream release could substitute a malicious executable after this skill has been audited.

The risk is elevated because the CLI is expected to process Google OAuth client credentials and cached YouTube authorization tokens. It can also perform account-affecting operations, including creating, updating, deleting, rejecting, and marking comments as spam. The global npm installation recommendation can additionally expose the executable broa
...[truncated 2348 chars]
Remediation
View remediation

Remediation Suggestions

  1. Pin immutable versions

    • Replace unversioned npm installation with a specific audited release, for example npm install --global @eat-pray-ai/yutu@<audited-version>.
    • Replace go install ...@latest with an audited semantic version or immutable commit.
    • Link to a specific release rather than /releases/latest.
    • Pin Homebrew and Winget package versions where supported.

  2. Verify downloaded artifacts

    • Publish SHA-256 or stronger digests for every supported binary.
    • Document an explicit checksum-verification command before execution.
    • Prefer cryptographically signed releases and verify signatures against a documented, independently distributed maintainer key.
    • Where available, verify package provenance or build attestations.

  3. Reduce installation scope

    • Avoid global installation where practical.
    • Run the dependency in a dedicated environment, container, or restricted user account.
    • Ensure the executable is not installed with administrator or root privileges unless strictly required.

  4. Protect OAuth material

    • Store credential and token files with owner-only permissions.
    • Grant only the minimum OAuth scopes needed for the requested operation.
    • Avoid exposing credentials through command-line arguments, logs, or broadly inherited environment variables.
    • Revoke and rotate tokens immediately if dependency compromise is suspected.

  5. Establish dependency governance

    • Record the approved version and its digest in the skill documentation or lockfile.
    • Review release changes before updating the approved version.
    • Automate vulnerability, provenance, and integrity checks in the release process.
    • Document the expected package owner, repository, signing identity, and official distribution channels to reduce dependency-confusion and spoofing risks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description embeds many natural-language triggers, several of which are generic enough to overlap with ordinary user requests outside a narrowly scoped invocation context. The file does not provide exclusion conditions, negative examples, or other constraints to clarify when the skill should activate versus when it should not.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill exposes destructive actions such as deleting comments, marking them as spam, and changing moderation status without explicit warnings or confirmation guidance. In an agentic environment, this increases the risk of accidental or socially engineered execution of irreversible or reputation-impacting actions against a YouTube account.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

This documentation exposes a destructive operation that permanently deletes YouTube comments but does not warn the user that the action is irreversible or encourage confirmation before execution. In a skill specifically designed to manage comments, omission of a safety warning increases the chance of accidental mass deletion, especially when multiple IDs can be supplied in one command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The setup guide instructs users to store an OAuth client secret and a cached OAuth token locally, but it does not warn that these files are sensitive credentials that can grant access to YouTube account capabilities. In documentation for an agent skill, this omission increases the chance users will leave tokens in insecure locations, commit them to source control, or expose them through logs or shared workspaces.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.