Security audit

YouTube Subscription

Security checks for vulnerabilities and agentic risk

Overview

This skill is aimed at managing YouTube subscriptions, but it needs Review because it can change a YouTube account and uses sensitive OAuth tokens through an unpinned third-party CLI.

Install only if you are comfortable granting a third-party CLI access to your YouTube account. Verify the yutu package source and version, protect the OAuth credential and token files, and require an explicit review/confirmation step before running insert or delete commands, especially bulk deletion.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/setup.md:34
Finding: Unpinned and Unverified Third-Party CLI Installation
Content: View full analysis
Remediation: View remediation
``` 2. Replace `@latest` in the Go installation command with a reviewed semantic version or immutable commit: ```bash go install github.com/eat-pray-ai/yutu@ ``` 3. Pin the version in `SKILL.md` installation metadata if the Skill schema supports version constraints or immutable package references. 4. Publish SHA-256 checksums and, preferably, cryptographic signatures for release binaries. Require users to verify both before placing a binary in `PATH`. 5. Document the expected package owner, repository, release version, checksum, and signature-verification procedure so users can detect package substitution. 6. Use lockfiles, package-manager lock mechanisms, or an internally mirrored and reviewed artifact where supported. 7. Avoid global installation where practical. Run the dependency in a constrained environment with access only to the files and network destinations required for YouTube API operations. 8. Request only the minimum necessary Google OAuth scopes and protect cached tokens with restrictive filesystem permissions. Do not expose credential or token contents in debug logs. 9. Establish a dependency-update review process that verifies source changes, build provenance, package signatures, and published artifact hashes before updating the pinned version. ]]>

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.
md
bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.
md
bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.
md
bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.
md
bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description embeds many broad trigger phrases such as 'list subscription' and 'delete subscription' that can overlap with ordinary user requests. In agent-routing systems, this can cause the skill to activate unexpectedly and steer users into actions affecting YouTube account state, including subscription changes, without sufficiently precise scoping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill documents destructive delete/unsubscribe capability but does not prominently warn that these actions modify the user's YouTube account state. In an agent setting, lack of an explicit warning and confirmation step increases the chance of accidental account changes or misuse through ambiguous prompts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The documentation provides direct deletion commands for YouTube subscriptions without any warning, confirmation guidance, or emphasis that the action is destructive. In an agent skill context, this increases the chance that a user or automated system invokes irreversible account changes based on terse prompts, leading to unintended unsubscribes or bulk deletion.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.