YouTube Memberships Level

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:50 PM UTC
• Version: 0.10.7-dev

Overview

This skill appears purpose-aligned, but it should be reviewed because it combines an unpinned third-party CLI with locally stored YouTube OAuth credentials and limited credential-safety guidance.

Review this before installing. Use a non-privileged account, install a pinned and verified yutu release where possible, keep client_secret.json and youtube.token.json outside source-controlled folders, restrict their file permissions, and revoke or rotate the OAuth token if either file is exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:17

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-21; references/setup.md:36-53
Vulnerability Type: Unpinned and mutable third-party dependencies
Risk Level: Medium

The Skill installs and executes the third-party yutu CLI without pinning an audited version, immutable commit, checksum, or cryptographic signature.

Vulnerable Code

SKILL.md:17-21:

yaml

install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

references/setup.md:36-53:

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

markdown

### Other platforms

Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH.

Technical Analysis

The npm package declaration and installation command omit an exact version. The Go installation explicitly uses the mutable @latest reference, while the binary download points to a mutable latest-release URL. Package-manager installations likewise do not identify an audited release.

Consequently, the artifact installed when a user follows these instructions can differ from the artifact that existed when the Skill was audited. If the package registry account, source repository, release pipeline, package-manager formula, or publisher credentials are compromised, an attacker could distribute a modified executable under the expected package name. A global npm installation may also run package lifecycle scripts with the installing user's privileges.

This finding does not establish that the current yutu package is malicious. It identifies the absence of controls that bind installation to a reviewed artifact.

Attack Path

1. An attacker compromises an upstream publisher account, package registry entry, source rep ...[truncated 1560 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm dependency to a specific audited version, such as @eat-pray-ai/yutu@X.Y.Z, rather than allowing implicit latest-version resolution.
2. Replace go install github.com/eat-pray-ai/yutu@latest with an exact release tag or, preferably, an immutable commit.
3. Replace the mutable /releases/latest download with a version-specific release URL.
4. Publish SHA-256 checksums for supported binaries and document checksum verification before execution.
5. Verify signed release tags, package provenance, or cryptographic artifact signatures where supported.
6. Lock package-manager installation instructions to reviewed versions when the relevant manager supports version pinning.
7. Review npm lifecycle scripts and use --ignore-scripts where compatible with installation requirements.
8. Perform installation and initial validation with a non-privileged account in an isolated environment.
9. Restrict OAuth scopes to the minimum required for listing membership levels and protect token files with owner-only filesystem permissions.
10. Maintain a documented update process in which each new dependency version is reviewed, checksummed, and explicitly approved before the pin is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The setup guide instructs users to store an OAuth client secret and a cached OAuth token in local files but does not warn that these artifacts are sensitive and should be protected from accidental disclosure, source control commits, or unsafe file permissions. In a skill that helps manage YouTube resources, these tokens could enable unauthorized API access to the user's YouTube account if another local user, malware, or a leaked repository obtains them.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.