YouTube I18n Language

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:51 PM UTC
• Version: 0.10.7-dev

Overview

The skill appears to do its stated YouTube language-listing job, but it asks users to install a mutable third-party CLI and use local OAuth credential/token files without enough scope or storage guidance.

Review the yutu package and publisher before installing, prefer a pinned version or verified release, and keep client_secret.json and youtube.token.json out of source control and shared folders. Use the narrowest Google OAuth scopes possible, revoke or rotate tokens if exposed, and avoid granting optional YouTube APIs unless you need them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:35

Finding

Unpinned Third-Party CLI Installed with Access to OAuth Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:18-20; references/setup.md:35-50
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:18-20:

yaml

    - kind: node
      package: "@eat-pray-ai/yutu"
      bins: [yutu]

references/setup.md:35-50:

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

Technical Analysis

The Skill directs users to install a third-party executable without pinning an audited version. The Go installation explicitly uses the mutable @latest release, while the npm, Homebrew, and WinGet commands also resolve whichever version is current at installation time.

No lockfile, cryptographic checksum, signature-verification procedure, immutable release identifier, or vendored source is supplied. Consequently, the executable installed by a user can differ from the artifact that was originally reviewed.

This is particularly sensitive because the CLI is subsequently given access to client_secret.json and youtube.token.json. A malicious or compromised future release could read these files, extract OAuth material, make unauthorized API requests, or execute arbitrary commands under the installing user's account.

Attack Path

1. An attacker compromises a package registry account, upstream repository, release pipeline, package-manager formula, or a future version of the yutu project.
2. The attacker publishes a malicious version under the same package or release channel.
3. A user follows the documented installation command, which resolves the unpinned or latest version.
4. The package manager installs and executes the attacker-controlled CLI with the user's local privileges.
5. The user invokes yutu auth or `yutu i18nLanguage ...[truncated 801 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin an explicitly reviewed yutu version in every installation method instead of using mutable defaults or @latest.
2. Publish SHA-256 checksums and cryptographic signatures for prebuilt binaries, and require users to verify them before installation.
3. Use package-manager lockfiles or equivalent integrity metadata where supported.
4. Document the exact expected package publisher, repository, package identifier, and release provenance so users can detect dependency confusion or spoofed packages.
5. Prefer installation in an isolated environment rather than as a global executable.
6. Document and request only the minimum Google OAuth scopes required for listing internationalization languages.
7. Restrict filesystem permissions on client_secret.json and youtube.token.json, and advise users not to expose their contents through logs or shell history.
8. Add a release-review process that verifies the pinned source revision, build provenance, dependency tree, and distributed artifacts before updating the recommended version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide instructs users to create OAuth client secrets and cache OAuth tokens locally, but it does not warn that these files are sensitive credentials that can grant API access if exposed. In a developer setup context this is common documentation, but omitting storage, access-control, and rotation guidance increases the risk of accidental disclosure through source control, shared directories, backups, or logs.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The description says only 'List i18n languages' and 'Use this skill to list available internationalization languages,' which is generic and lacks boundaries or specific trigger phrasing. For a markdown file, this can create ambiguity about what user requests should activate the skill versus other language, localization, or listing tasks.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.