Security audit

YouTube Thumbnail

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it says, but it installs an unpinned third-party YouTube CLI and handles persistent OAuth credentials for account-changing actions without enough safety guidance.

Review before installing. Use this only if you trust the yutu CLI source and are comfortable granting YouTube API access that can modify video thumbnails. Pin and verify the CLI version where possible, keep client_secret.json and youtube.token.json out of repositories and logs, restrict file permissions, avoid putting raw secrets in environment variables, and revoke the OAuth token if it may have been exposed.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/setup.md:37
Finding: Unpinned Third-Party CLI Installation Creates a Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:17-20`, `references/setup.md:37-50` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17-20`: ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:37-50`: ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` The setup guide additionally directs users to download a prebuilt binary from the mutable `latest` release page without requiring checksum or signature verification. ### Technical Analysis The skill instructs users or an agent to install and execute the third-party `yutu` CLI without pinning a reviewed version. The Go installation explicitly selects `@latest`, while the npm, Homebrew, Winget, and release-page instructions similarly do not identify an immutable version or cryptographically verified artifact. Package-manager installation inherently retrieves executable content from external registries or repositories. Because the retrieved version can change after this skill has been reviewed, a compromised publisher account, package registry, source repository, release workflow, or distribution channel could cause users to install attacker-controlled code. The installed CLI is subsequently given access to sensitive Google OAuth material through `client_secret.json`, `youtube.token.json`, `YUTU_CREDENTIAL`, and `YUTU_CACHE_TOKEN`. Consequently, dependency compromise would place those credentials within reach of malicious code executing under the user's account. No evidence establishes that the current `yutu` package is malicious. The vulnerability is the absence of dependency pinning, artifact integrity verification, and publisher-validation controls. ### Attack Path 1. An attacker compromises the package publisher, registry ac ...[truncated 1547 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin every installation method to a specific reviewed version rather than using mutable defaults or `@latest`. 2. For downloaded binaries, publish SHA-256 or stronger checksums through an independently protected channel and require verification before execution. 3. Prefer cryptographically signed releases and document signature verification, including the expected signing identity or public key. 4. Identify the expected npm publisher, source repository, Homebrew tap, and Winget publisher so users can detect dependency confusion or spoofed packages. 5. Use lockfiles or equivalent integrity metadata where the surrounding skill platform supports them. 6. Avoid global installation when possible. Run the CLI in an isolated environment with access only to the thumbnail file and required credential material. 7. Grant the narrowest Google OAuth scopes necessary for thumbnail management and document those scopes explicitly. 8. Restrict credential and token file permissions to the owning user, avoid exposing their contents in logs, and provide token-revocation and rotation instructions. 9. Subject each pinned release to source review, malware scanning, and provenance verification before updating the documented version. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger phrases are broad enough to match ordinary user requests like 'set thumbnail' or 'set my thumbnail', which can cause the skill to activate in contexts the user did not explicitly intend. Because this skill performs an authenticated action against YouTube, unintended invocation could lead to accidental modification of a video's thumbnail.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The setup guide instructs users to download OAuth client credentials and persist both the client secret and the resulting access token to predictable local files, but it does not warn that these are sensitive secrets that grant API access. In agent or shared-machine contexts, such files are commonly committed, logged, copied into workspaces, or exposed through weak filesystem permissions, increasing the chance of credential theft.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The documentation allows OAuth client secrets and cached tokens to be supplied directly via environment variables, including raw base64 or JSON, without warning about secret exposure risks. Environment variables are frequently leaked through shell history, process listings, CI logs, crash reports, and debugging output, especially in automated agent workflows.

Static analysis

No suspicious patterns detected.