YouTube I18n Region

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:50 PM UTC
• Version: 0.10.7-dev

Overview

This skill is a narrow YouTube region-listing helper, but it asks users to install an unpinned third-party CLI and provide reusable OAuth credentials without clear scope or secret-handling guidance.

Review this skill before installing. Use a dedicated Google project/account where possible, confirm the exact OAuth scopes yutu requests, keep client_secret.json and youtube.token.json out of repositories and shared folders, restrict file permissions, and prefer a pinned or otherwise verified yutu release.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:15

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:15-18, references/setup.md:37-56
Vulnerability Type: Unpinned and insufficiently verified third-party dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:15-18

yaml

    install:
      - kind: node
        package: "@eat-pray-ai/yutu"
        bins: [yutu]

references/setup.md:37-56

bash

```bash
# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

Technical Analysis

The skill directs users and compatible agent runtimes to install the external yutu CLI without pinning an audited version, immutable commit, package digest, or release checksum. The Go installation explicitly uses the mutable @latest reference, while the npm, Homebrew, and Winget instructions similarly resolve whatever version is current when installation occurs.

The commands also perform global or system-level installation. Consequently, the code reviewed during the skill audit is not necessarily the code later executed by users. Although no evidence shows that the referenced package is currently malicious, compromise of a package registry account, upstream repository, release pipeline, or package source could replace the effective executable after this skill has been reviewed.

Attack Path

1. An attacker compromises an upstream package account, repository, build pipeline, or distribution source used for yutu.
2. The attacker publishes a malicious release under the expected package or application identity.
3. A user or agent follows one of the unpinned installation commands.
4. The package manager resolves and globally installs the attacker-controlled release.
5. When yutu is installed or invoked, malicious package lifecycle logic or executable code runs with the installing user's p ...[truncated 773 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @eat-pray-ai/yutu to a specific audited version rather than allowing the package manager to resolve the latest release.
2. Replace github.com/eat-pray-ai/yutu@latest with an immutable version or audited commit hash.
3. Identify the expected Homebrew tap, Winget publisher, package identifier, and official distribution source explicitly.
4. Publish and verify SHA-256 checksums or cryptographic signatures for downloaded binaries.
5. Use package-manager lock or integrity metadata where supported.
6. Prefer local, isolated installation over global installation when operationally possible.
7. Document a trusted upgrade process that requires review before changing the pinned release.
8. Run the CLI with only the filesystem and credential access required for the requested operation.

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: references/setup.md:17

Finding

Reusable OAuth Credentials Are Required Without Documented Least-Privilege Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:7-14, references/setup.md:17-30, references/setup.md:57-63
Vulnerability Type: Excessive credential exposure and insufficiently documented OAuth scope restrictions
Risk Level: Medium

Vulnerable Code

SKILL.md:7-14

yaml

  openclaw:
    requires:
      env:
        - YUTU_CREDENTIAL
        - YUTU_CACHE_TOKEN
      bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json

references/setup.md:17-30

markdown

2. **Create OAuth credentials**:
   - Go to `APIs & Services -> OAuth consent screen`, create a consent screen with yourself as a test user
   - Go to `Credentials -> Create Credentials -> OAuth Client ID`, select `Web Application`
   - Add `http://localhost:8216` as an authorized redirect URI
   - Download the credential file and save it as `client_secret.json`

3. **Authenticate**:

   ```bash
   yutu auth --credential client_secret.json
   ```

   A browser window will open for you to grant YouTube access. After granting permission, a token is saved to `youtube.token.json`.

references/setup.md:57-63

markdown

## Environment Variables

| Variable | Description | Default |
|----------|-------------|---------|
| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

Technical Analysis

The skill's only documented operation is listing internationalization regions, but setup requires an OAuth client credential and a reusable cached YouTube token for a general-purpose third-party CLI. The documentation describes granting general “YouTube access” without identifyin ...[truncated 2188 chars]

Remediation

View remediation

Remediation Suggestions

1. Determine whether listing internationalization regions can use unauthenticated access or a restricted API key instead of user OAuth credentials.
2. If OAuth is mandatory, explicitly document and enforce the minimum read-only scopes needed for this operation.
3. Explain each requested OAuth scope and reject broader scopes that are unrelated to region listing.
4. Separate credentials for this narrow skill from credentials used by other yutu operations.
5. Store cached tokens in an operating-system credential store or another protected secret store where supported.
6. Require restrictive file permissions for credential files, such as owner-only access on supported systems.
7. Prefer environment variables containing paths or secret-store references over raw or base64-encoded credential JSON.
8. Ensure credential values are redacted from logs, diagnostics, command output, and crash reports.
9. Document token expiration, revocation, and rotation procedures.
10. Run the CLI in a restricted environment that exposes only the credential needed for the current invocation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to save OAuth client secrets and cached access tokens to predictable local filenames but does not warn that these files are sensitive or should be excluded from source control, shared folders, backups, or broad filesystem permissions. In a developer-tooling context, that omission can lead to accidental credential exposure and subsequent unauthorized access to the user's YouTube API account and data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The flag description uses 'Host language' as the sole locale mechanism, while the rest of the skill documentation is fixed in English and does not state that users may choose their preferred language or locale behavior. Under the language/locale policy rule, documentation that appears to assume a default language without explicit opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.