YouTube Playlist Image

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:56 PM UTC
• Version: 0.10.7-dev

Overview

The skill does what it says, but it handles YouTube OAuth credentials and can delete or modify YouTube playlist imagery without enough safety guidance.

Install only if you trust the yutu package source and are comfortable granting it YouTube account access. Pin or verify the yutu version where possible, protect client_secret.json and youtube.token.json with restrictive permissions, keep them out of git and shared folders, and manually verify playlist image IDs before using delete commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:30

Finding

Unpinned Third-Party Executables Handle Sensitive OAuth Credentials

Content

View full analysis

Vulnerability Details

File Location: references/setup.md, lines 30-54; related package declaration in SKILL.md, lines 18-21
Vulnerability Type: Supply-chain exposure through unpinned executable dependencies
Risk Level: Medium

Vulnerable Code

From references/setup.md, lines 30-54:

bash

## Installation

Install `yutu` using one of these methods:


```bash
# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

Other platforms

Download a prebuilt binary from the releases page and place it in your PATH.

text

Related declaration in `SKILL.md`, lines 18-21:

```yaml
install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

Technical Analysis

The installation instructions do not pin an audited package version, immutable source commit, or release artifact. The Go instruction explicitly uses @latest, the binary link resolves through the mutable /releases/latest endpoint, and the npm declaration has no version constraint. No checksum or cryptographic-signature verification is documented.

This creates a supply-chain trust boundary in which the executable installed at audit time can differ from the executable installed later. The risk is amplified because the installed yutu binary is subsequently given access to OAuth client credentials and cached YouTube tokens through client_secret.json, youtube.token.json, YUTU_CREDENTIAL, and YUTU_CACHE_TOKEN.

The audit did not establish that the current upstream package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process and the absence of artifact verification.

Attack Path

1. An attacker compromises an upstream package account, release pipeline, package- ...[truncated 1392 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to a specific audited version rather than resolving the current default version.
2. Replace go install github.com/eat-pray-ai/yutu@latest with an immutable release tag or, preferably, an audited commit digest.
3. Replace the mutable /releases/latest download with a version-specific artifact URL.
4. Publish SHA-256 checksums and cryptographic signatures for every binary, and document mandatory verification before installation.
5. Document the exact trusted Homebrew tap and Winget package identifier, including publisher verification.
6. Use lockfiles or equivalent integrity metadata where the installation mechanism supports them.
7. Run the CLI with least privilege and never require administrator rights unless strictly necessary.
8. Request only the minimum required Google OAuth scopes.
9. Store credential and token files with owner-only filesystem permissions, keep them outside shared directories, and exclude them from version control.
10. Establish a dependency-update review process that verifies source changes, release provenance, checksums, and signatures before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The markdown describes delete operations for playlist images and lists a delete command, but it does not warn users that deleting a playlist image is a potentially destructive action affecting YouTube content. Under the markdown-specific warning criteria, behaviors that can affect user data or system integrity should include an explicit warning.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This documentation instructs users to perform a destructive delete operation without any warning that the action may be permanent, affect multiple resources when comma-separated IDs are provided, or require confirmation. In an agent skill context, terse command examples can be turned into direct execution steps, increasing the chance of accidental deletion by users or downstream automation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The setup guide instructs users to store an OAuth client secret and a cached OAuth token in predictable local files, but does not warn that these files are sensitive or should be excluded from source control and protected with restrictive permissions. If these files are exposed through repository commits, backups, shared folders, or logs, an attacker could reuse them to access the user's YouTube account or API project.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.