YouTube Super Chat Event

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 11:40 PM UTC
• Version: 0.10.7-dev

Overview

This skill is a disclosed wrapper for the yutu CLI to list YouTube Super Chat events, with expected OAuth setup and a supply-chain caution around the unpinned CLI install.

Install only if you trust the yutu CLI source and are comfortable granting it YouTube OAuth access. Prefer a pinned or verified yutu version where possible, keep client_secret.json and youtube.token.json private, and grant only the YouTube permissions needed for listing Super Chat events.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:38

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Location: references/setup.md:38-52; related package declaration at SKILL.md:17-20
Vulnerability Type: Unpinned and unverifiable third-party dependencies
Risk Level: Medium

Vulnerable Code

references/setup.md:38-52:

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

The same guide also recommends downloading an unverified prebuilt binary:

markdown

Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH.

Related declaration in SKILL.md:17-20:

yaml

install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

Technical Analysis

The installation instructions resolve and execute mutable third-party artifacts without pinning an audited version, immutable commit, checksum, or cryptographic signature. The Go instruction explicitly uses @latest, while the npm, Homebrew, Winget, and release-page instructions similarly select whichever artifact is current when installation occurs.

Consequently, the executable installed by a user can differ from the version that was reviewed. If the upstream repository, package registry account, release pipeline, package-manager manifest, or maintainer credentials are compromised, an attacker could publish a malicious version under the legitimate package identity. A dependency-confusion or typosquatting condition was not observed in the audited files; the confirmed weakness is the absence of immutable version and integrity controls.

This risk is amplified because the CLI requires access to Google OAuth material through YUTU_CREDENTIAL, YUTU_CACHE_TOKEN, client_secret.json, and youtube.token.json. A compromised executable would run in the same user ...[truncated 1881 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin yutu to a specifically reviewed version rather than relying on the current default or @latest.
2. For Go installation, use an explicit version such as go install github.com/eat-pray-ai/yutu@vX.Y.Z.
3. For npm installation, specify an exact version and avoid version ranges, for example npm install --global @eat-pray-ai/yutu@X.Y.Z.
4. Pin the package version in the SKILL.md installation metadata if the platform supports version constraints.
5. Publish SHA-256 checksums for prebuilt binaries and require users or automated installers to verify them before execution.
6. Prefer cryptographically signed releases and document signature verification using a trusted, separately distributed public key.
7. Pin package-manager formulas or manifests to reviewed versions where supported, and verify their provenance and integrity metadata.
8. Avoid global installation where practical. Run the CLI in a restricted environment with only the minimum filesystem and network access required.
9. Grant the narrowest possible Google OAuth scopes and protect token files with owner-only filesystem permissions.
10. Establish a controlled upgrade process in which new versions are reviewed, integrity-verified, and explicitly approved before the documented pin is changed.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Static analysis

No suspicious patterns detected.