YouTube I18n Region

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:50 PM UTC
• Version: 0.10.7-dev

Overview

This skill is a narrow YouTube region-listing helper, but it asks users to install an unpinned third-party CLI and provide reusable OAuth credentials without clear scope or secret-handling guidance.

Review this skill before installing. Use a dedicated Google project/account where possible, confirm the exact OAuth scopes yutu requests, keep client_secret.json and youtube.token.json out of repositories and shared folders, restrict file permissions, and prefer a pinned or otherwise verified yutu release.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15
• Finding: Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `SKILL.md:15-18`, `references/setup.md:37-56` **Vulnerability Type**: Unpinned and insufficiently verified third-party dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:15-18` ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:37-56` ```bash ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ### Technical Analysis The skill directs users and compatible agent runtimes to install the external `yutu` CLI without pinning an audited version, immutable commit, package digest, or release checksum. The Go installation explicitly uses the mutable `@latest` reference, while the npm, Homebrew, and Winget instructions similarly resolve whatever version is current when installation occurs. The commands also perform global or system-level installation. Consequently, the code reviewed during the skill audit is not necessarily the code later executed by users. Although no evidence shows that the referenced package is currently malicious, compromise of a package registry account, upstream repository, release pipeline, or package source could replace the effective executable after this skill has been reviewed. ### Attack Path 1. An attacker compromises an upstream package account, repository, build pipeline, or distribution source used for `yutu`. 2. The attacker publishes a malicious release under the expected package or application identity. 3. A user or agent follows one of the unpinned installation commands. 4. The package manager resolves and globally installs the attacker-controlled release. 5. When `yutu` is installed or invoked, malicious package lifecycle logic or executable code runs with the installing user's p ...[truncated 773 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@eat-pray-ai/yutu` to a specific audited version rather than allowing the package manager to resolve the latest release. 2. Replace `github.com/eat-pray-ai/yutu@latest` with an immutable version or audited commit hash. 3. Identify the expected Homebrew tap, Winget publisher, package identifier, and official distribution source explicitly. 4. Publish and verify SHA-256 checksums or cryptographic signatures for downloaded binaries. 5. Use package-manager lock or integrity metadata where supported. 6. Prefer local, isolated installation over global installation when operationally possible. 7. Document a trusted upgrade process that requires review before changing the pinned release. 8. Run the CLI with only the filesystem and credential access required for the requested operation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/setup.md:17
• Finding: Reusable OAuth Credentials Are Required Without Documented Least-Privilege Scope## Vulnerability Details **File Location**: `SKILL.md:7-14`, `references/setup.md:17-30`, `references/setup.md:57-63` **Vulnerability Type**: Excessive credential exposure and insufficiently documented OAuth scope restrictions **Risk Level**: Medium ### Vulnerable Code `SKILL.md:7-14` ```yaml openclaw: requires: env: - YUTU_CREDENTIAL - YUTU_CACHE_TOKEN bins: - yutu config: - client_secret.json - youtube.token.json ``` `references/setup.md:17-30` ```markdown 2. **Create OAuth credentials**: - Go to `APIs & Services -> OAuth consent screen`, create a consent screen with yourself as a test user - Go to `Credentials -> Create Credentials -> OAuth Client ID`, select `Web Application` - Add `http://localhost:8216` as an authorized redirect URI - Download the credential file and save it as `client_secret.json` 3. **Authenticate**: ```bash yutu auth --credential client_secret.json ``` A browser window will open for you to grant YouTube access. After granting permission, a token is saved to `youtube.token.json`. ``` `references/setup.md:57-63` ```markdown ## Environment Variables | Variable | Description | Default | |----------|-------------|---------| | `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` | | `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` | | `YUTU_ROOT` | Root directory for file resolution | Current working directory | | `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` | ``` ### Technical Analysis The skill's only documented operation is listing internationalization regions, but setup requires an OAuth client credential and a reusable cached YouTube token for a general-purpose third-party CLI. The documentation describes granting general “YouTube access” without identifyin ...[truncated 2188 chars]
• Remediation: ## Remediation Suggestions 1. Determine whether listing internationalization regions can use unauthenticated access or a restricted API key instead of user OAuth credentials. 2. If OAuth is mandatory, explicitly document and enforce the minimum read-only scopes needed for this operation. 3. Explain each requested OAuth scope and reject broader scopes that are unrelated to region listing. 4. Separate credentials for this narrow skill from credentials used by other `yutu` operations. 5. Store cached tokens in an operating-system credential store or another protected secret store where supported. 6. Require restrictive file permissions for credential files, such as owner-only access on supported systems. 7. Prefer environment variables containing paths or secret-store references over raw or base64-encoded credential JSON. 8. Ensure credential values are redacted from logs, diagnostics, command output, and crash reports. 9. Document token expiration, revocation, and rotation procedures. 10. Run the CLI in a restricted environment that exposes only the credential needed for the current invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guide instructs users to save OAuth client secrets and cached access tokens to predictable local filenames but does not warn that these files are sensitive or should be excluded from source control, shared folders, backups, or broad filesystem permissions. In a developer-tooling context, that omission can lead to accidental credential exposure and subsequent unauthorized access to the user's YouTube API account and data.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The flag description uses 'Host language' as the sole locale mechanism, while the rest of the skill documentation is fixed in English and does not state that users may choose their preferred language or locale behavior. Under the language/locale policy rule, documentation that appears to assume a default language without explicit opt-in can be a policy concern.

Static analysis

No suspicious patterns detected.