YouTube Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 10:56 PM UTC
• Version: 0.10.7-dev

Overview

The skill is a coherent YouTube search helper, but it asks users to install a mutable third-party CLI and handle YouTube OAuth secrets without enough scoping or safety guidance.

Review the `yutu` publisher and install source before use, prefer a pinned and verified version, grant only the minimum YouTube API scopes needed for search, and store `client_secret.json` and `youtube.token.json` outside repositories with restrictive permissions. Revoke or rotate the OAuth token if either file is exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:37

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:16-19; references/setup.md:37-53
Vulnerability Type: Unpinned and mutable third-party executable installation
Risk Level: Medium

The skill directs users to install the external yutu CLI without pinning an audited version or requiring artifact integrity verification.

Relevant code from SKILL.md:16-19:

yaml

install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

Relevant code from references/setup.md:37-53:

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

text

Download a prebuilt binary from the releases page and place it in your PATH.

Technical Analysis

The installation declarations and setup instructions resolve mutable upstream package or release versions. In particular, the Go command explicitly requests @latest, while the npm, Homebrew, WinGet, and release-page instructions do not specify an audited version or require checksum or signature validation.

This creates a supply-chain trust boundary that is not controlled by the skill package. If an upstream publisher account, package registry entry, repository release, package-manager formula, or distribution artifact is compromised, users following these instructions may receive code different from the code originally reviewed.

The risk is elevated because the installed CLI is subsequently entrusted with OAuth client credentials and a cached YouTube OAuth token through client_secret.json, youtube.token.json, YUTU_CREDENTIAL, and YUTU_CACHE_TOKEN. There is no evidence in the reviewed project that the current upstream package is malicious; exploitation depends on compromise or malicious replacement of a mutable upstream artifact.

Attack Path

1. An attacker c ...[truncated 1574 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every installation method to a specific, reviewed version rather than using implicit latest versions or @latest.
2. For Go installations, use an explicit immutable version such as github.com/eat-pray-ai/yutu@vX.Y.Z.
3. For npm, document an exact package version and consider using a project-local installation with a lockfile instead of an unrestricted global installation.
4. Publish and verify cryptographic checksums for downloaded binaries. Prefer signed releases and document signature verification commands.
5. Record the expected package publisher, repository, release version, and artifact digest so users can detect dependency confusion or substituted artifacts.
6. Avoid administrative installation or execution unless strictly necessary; run the CLI with least privilege.
7. Request only the minimum OAuth scopes needed for search operations, and document how users can inspect and revoke access.
8. Store OAuth token and client-secret files with restrictive filesystem permissions and keep them outside shared or version-controlled directories.
9. Establish a dependency update process in which new versions are reviewed and their pinned versions and hashes are updated deliberately.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The manifest description lists triggers such as "search resources" and "list search," which are generic phrases that could plausibly appear in ordinary conversation outside a narrowly defined YouTube context. The file does not provide explicit constraints, exclusion conditions, or negative examples to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The guide instructs users to save OAuth client credentials and a cached access token locally, but it does not warn that these files are sensitive or recommend protections such as restricted permissions, secure storage, or excluding them from version control. If exposed, an attacker could reuse the OAuth material to access the user's YouTube-related account data or APIs within the granted scope.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.