YouTube Thumbnail

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:42 PM UTC
• Version: 0.10.7-dev

Overview

This skill does what it says, but it installs an unpinned third-party YouTube CLI and handles persistent OAuth credentials for account-changing actions without enough safety guidance.

Review before installing. Use this only if you trust the yutu CLI source and are comfortable granting YouTube API access that can modify video thumbnails. Pin and verify the CLI version where possible, keep client_secret.json and youtube.token.json out of repositories and logs, restrict file permissions, avoid putting raw secrets in environment variables, and revoke the OAuth token if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:37

Finding

Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough to match ordinary user requests like 'set thumbnail' or 'set my thumbnail', which can cause the skill to activate in contexts the user did not explicitly intend. Because this skill performs an authenticated action against YouTube, unintended invocation could lead to accidental modification of a video's thumbnail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide instructs users to download OAuth client credentials and persist both the client secret and the resulting access token to predictable local files, but it does not warn that these are sensitive secrets that grant API access. In agent or shared-machine contexts, such files are commonly committed, logged, copied into workspaces, or exposed through weak filesystem permissions, increasing the chance of credential theft.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation allows OAuth client secrets and cached tokens to be supplied directly via environment variables, including raw base64 or JSON, without warning about secret exposure risks. Environment variables are frequently leaked through shell history, process listings, CI logs, crash reports, and debugging output, especially in automated agent workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.