ClawHub
Back to skill

Security audit

YouTube Member

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent YouTube member-listing helper, with expected OAuth token handling and third-party CLI installation risks users should manage.

Before installing, verify that the yutu package comes from the expected publisher, avoid running installation with unnecessary administrator privileges, keep client_secret.json and youtube.token.json out of source control and shared folders, and revoke or rotate the Google token if either file is exposed.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:15
Finding

Unpinned Third-Party CLI Installation Enables Supply-Chain Code Execution

Content
View full analysis
Remediation
View remediation
" bins: [yutu] ``` 2. Replace `go install github.com/eat-pray-ai/yutu@latest` with an explicit immutable release tag or, preferably, a verified commit-based version. 3. Replace mutable `releases/latest` instructions with a link to a specific release. Publish and require verification of SHA-256 checksums or cryptographic signatures before execution. 4. Document the expected publisher, repository, package scope, and approved package-manager sources so users can identify substituted packages or unofficial taps. 5. Use automated dependency monitoring while requiring security review before changing the pinned version. 6. Avoid privileged or administrator installation where possible. Run the CLI using a dedicated, least-privileged account or isolated environment. 7. Request only the minimum Google OAuth scopes required to list channel members. 8. Store `client_secret.json` and `youtube.token.json` with restrictive filesystem permissions, keep them outside shared directories, and ensure they are excluded from source control. 9. Provide token revocation and rotation instructions for suspected dependency compromise. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md
bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The setup guide tells users to download an OAuth client secret and store a cached OAuth token locally, but it provides no warning that these files are sensitive credentials that can enable unauthorized access if exposed. In documentation for a CLI skill, this omission is risky because users may leave the files in insecure locations, commit them to source control, or share them unintentionally.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description lists triggers such as "list member" and "list my member" without defining scope, context, or negative examples. These phrases are short and could match user requests outside a narrowly defined YouTube-channel-member workflow, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.