YouTube Playlist Image

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:56 PM UTC
• Version: 0.10.7-dev

Overview

The skill does what it says, but it handles YouTube OAuth credentials and can delete or modify YouTube playlist imagery without enough safety guidance.

Install only if you trust the yutu package source and are comfortable granting it YouTube account access. Pin or verify the yutu version where possible, protect client_secret.json and youtube.token.json with restrictive permissions, keep them out of git and shared folders, and manually verify playlist image IDs before using delete commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:30
• Finding: Unpinned Third-Party Executables Handle Sensitive OAuth Credentials## Vulnerability Details **File Location**: `references/setup.md`, lines 30-54; related package declaration in `SKILL.md`, lines 18-21 **Vulnerability Type**: Supply-chain exposure through unpinned executable dependencies **Risk Level**: Medium ### Vulnerable Code From `references/setup.md`, lines 30-54: ```bash ## Installation Install `yutu` using one of these methods: ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ### Other platforms Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH. ``` Related declaration in `SKILL.md`, lines 18-21: ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` ### Technical Analysis The installation instructions do not pin an audited package version, immutable source commit, or release artifact. The Go instruction explicitly uses `@latest`, the binary link resolves through the mutable `/releases/latest` endpoint, and the npm declaration has no version constraint. No checksum or cryptographic-signature verification is documented. This creates a supply-chain trust boundary in which the executable installed at audit time can differ from the executable installed later. The risk is amplified because the installed `yutu` binary is subsequently given access to OAuth client credentials and cached YouTube tokens through `client_secret.json`, `youtube.token.json`, `YUTU_CREDENTIAL`, and `YUTU_CACHE_TOKEN`. The audit did not establish that the current upstream package is malicious. The vulnerability is the unsafe, mutable dependency acquisition process and the absence of artifact verification. ### Attack Path 1. An attacker compromises an upstream package account, release pipeline, package- ...[truncated 1392 chars]
• Remediation: ## Remediation Suggestions 1. Pin the npm package to a specific audited version rather than resolving the current default version. 2. Replace `go install github.com/eat-pray-ai/yutu@latest` with an immutable release tag or, preferably, an audited commit digest. 3. Replace the mutable `/releases/latest` download with a version-specific artifact URL. 4. Publish SHA-256 checksums and cryptographic signatures for every binary, and document mandatory verification before installation. 5. Document the exact trusted Homebrew tap and Winget package identifier, including publisher verification. 6. Use lockfiles or equivalent integrity metadata where the installation mechanism supports them. 7. Run the CLI with least privilege and never require administrator rights unless strictly necessary. 8. Request only the minimum required Google OAuth scopes. 9. Store credential and token files with owner-only filesystem permissions, keep them outside shared directories, and exclude them from version control. 10. Establish a dependency-update review process that verifies source changes, release provenance, checksums, and signatures before changing the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (7)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The markdown describes delete operations for playlist images and lists a delete command, but it does not warn users that deleting a playlist image is a potentially destructive action affecting YouTube content. Under the markdown-specific warning criteria, behaviors that can affect user data or system integrity should include an explicit warning.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: This documentation instructs users to perform a destructive delete operation without any warning that the action may be permanent, affect multiple resources when comma-separated IDs are provided, or require confirmation. In an agent skill context, terse command examples can be turned into direct execution steps, increasing the chance of accidental deletion by users or downstream automation.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guide instructs users to store an OAuth client secret and a cached OAuth token in predictable local files, but does not warn that these files are sensitive or should be excluded from source control and protected with restrictive permissions. If these files are exposed through repository commits, backups, shared folders, or logs, an attacker could reuse them to access the user's YouTube account or API project.

Static analysis

No suspicious patterns detected.