YouTube I18n Language

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:51 PM UTC
• Version: 0.10.7-dev

Overview

The skill appears to do its stated YouTube language-listing job, but it asks users to install a mutable third-party CLI and use local OAuth credential/token files without enough scope or storage guidance.

Review the yutu package and publisher before installing, prefer a pinned version or verified release, and keep client_secret.json and youtube.token.json out of source control and shared folders. Use the narrowest Google OAuth scopes possible, revoke or rotate tokens if exposed, and avoid granting optional YouTube APIs unless you need them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:35
• Finding: Unpinned Third-Party CLI Installed with Access to OAuth Credentials## Vulnerability Details **File Location**: `SKILL.md:18-20`; `references/setup.md:35-50` **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code `SKILL.md:18-20`: ```yaml - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:35-50`: ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ### Technical Analysis The Skill directs users to install a third-party executable without pinning an audited version. The Go installation explicitly uses the mutable `@latest` release, while the npm, Homebrew, and WinGet commands also resolve whichever version is current at installation time. No lockfile, cryptographic checksum, signature-verification procedure, immutable release identifier, or vendored source is supplied. Consequently, the executable installed by a user can differ from the artifact that was originally reviewed. This is particularly sensitive because the CLI is subsequently given access to `client_secret.json` and `youtube.token.json`. A malicious or compromised future release could read these files, extract OAuth material, make unauthorized API requests, or execute arbitrary commands under the installing user's account. ### Attack Path 1. An attacker compromises a package registry account, upstream repository, release pipeline, package-manager formula, or a future version of the `yutu` project. 2. The attacker publishes a malicious version under the same package or release channel. 3. A user follows the documented installation command, which resolves the unpinned or `latest` version. 4. The package manager installs and executes the attacker-controlled CLI with the user's local privileges. 5. The user invokes `yutu auth` or `yutu i18nLanguage ...[truncated 801 chars]
• Remediation: ## Remediation Suggestions 1. Pin an explicitly reviewed `yutu` version in every installation method instead of using mutable defaults or `@latest`. 2. Publish SHA-256 checksums and cryptographic signatures for prebuilt binaries, and require users to verify them before installation. 3. Use package-manager lockfiles or equivalent integrity metadata where supported. 4. Document the exact expected package publisher, repository, package identifier, and release provenance so users can detect dependency confusion or spoofed packages. 5. Prefer installation in an isolated environment rather than as a global executable. 6. Document and request only the minimum Google OAuth scopes required for listing internationalization languages. 7. Restrict filesystem permissions on `client_secret.json` and `youtube.token.json`, and advise users not to expose their contents through logs or shell history. 8. Add a release-review process that verifies the pinned source revision, build provenance, dependency tree, and distributed artifacts before updating the recommended version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup guide instructs users to create OAuth client secrets and cache OAuth tokens locally, but it does not warn that these files are sensitive credentials that can grant API access if exposed. In a developer setup context this is common documentation, but omitting storage, access-control, and rotation guidance increases the risk of accidental disclosure through source control, shared directories, backups, or logs.

Vague Triggers

Low

• Confidence: 83% confidence
• Finding: The description says only 'List i18n languages' and 'Use this skill to list available internationalization languages,' which is generic and lacks boundaries or specific trigger phrasing. For a markdown file, this can create ambiguity about what user requests should activate the skill versus other language, localization, or listing tasks.

Static analysis

No suspicious patterns detected.