YouTube Video Abuse Report Reason

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:41 PM UTC
• Version: 0.10.7-dev

Overview

The skill appears to perform its stated YouTube CLI task, but it relies on sensitive OAuth files and an unpinned third-party CLI without enough safety guidance.

Review this before installing. Use a pinned, trusted yutu release when possible; avoid raw JSON secrets in environment variables; keep client_secret.json and youtube.token.json outside shared or committed directories with restrictive permissions; and revoke or rotate OAuth access if either file may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:39

Finding

Unpinned and Unverified Third-Party CLI Installation

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:18-20
• references/setup.md:39-50

Vulnerability Type: Supply-chain exposure through mutable and unverified third-party dependencies
Risk Level: Medium

Affected Code in SKILL.md:

yaml

install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

Affected Code in references/setup.md:

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

The same setup guide also instructs users to download a prebuilt binary from the latest release page and place it in PATH, without documenting checksum or signature verification.

Technical Analysis

All documented installation methods resolve a mutable package or executable without pinning an audited version or verifying artifact integrity. The Go command explicitly uses the mutable @latest selector. The npm declaration and installation command omit a version, while the Homebrew and Winget instructions do not identify an exact repository, manifest, or immutable package revision.

The downloaded release binary is likewise intended to be placed directly in PATH without a documented cryptographic checksum or signature-verification procedure. Consequently, the code executed by users can differ from the dependency that was reviewed during this audit.

This risk is especially significant because the installed yutu process is expected to handle Google OAuth client credentials and cached YouTube access tokens through client_secret.json, youtube.token.json, YUTU_CREDENTIAL, and YUTU_CACHE_TOKEN. A compromised package registry, release account, package manifest, repository, or distribution channel could therefore deliver attacker-controlled code with access to this sensitive material.

Attack Path

1. A ...[truncated 1699 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin a specific, reviewed release version for every installation method rather than using implicit latest versions or @latest.
2. Pin Go installations to an immutable reviewed tag or commit.
3. Provide SHA-256 checksums for every prebuilt binary and document the exact verification commands users must run before execution.
4. Publish signed release artifacts and require signature verification using a documented trusted public key or a suitable provenance system such as Sigstore.
5. Identify the exact trusted Homebrew tap and Winget manifest or source instead of relying only on a generic package name.
6. Use package-manager lockfiles or integrity metadata wherever the Skill platform supports them.
7. Document the minimum OAuth scopes needed for the listing operation and avoid requesting unrelated YouTube permissions.
8. Recommend restrictive filesystem permissions for client_secret.json and youtube.token.json.
9. Advise users not to install or execute the CLI with administrative privileges unless strictly required.
10. Establish a release-review process that verifies source provenance, dependency changes, build reproducibility, and published artifact hashes before updating the pinned version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The authentication step tells the user to use a local OAuth client secret and notes that an access token will be saved to youtube.token.json, but it does not explain that both files are sensitive authentication material. A cached OAuth token can often be used directly until expiry or revocation, so undocumented local persistence creates avoidable credential exposure risk.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

3. Authenticate:

   bash

   yutu auth --credential client_secret.json
   

   A browser window will open for you to grant YouTube access. After granting permission, a token is saved to youtube.token.json.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

The environment variable table states that OAuth client secrets and cached tokens may be supplied as path, base64, or raw JSON. Encouraging secrets to be passed via environment variables or inline JSON without caution can increase accidental exposure through shell history, process inspection, CI logs, crash dumps, or debugging output.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

| Variable | Description | Default |
|----------|-------------|---------|
| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The setup guide instructs users to store an OAuth client secret and a cached OAuth token locally, but it provides no warning that these files are sensitive or that disclosure could allow unauthorized API access under the user's account or project. In a skill that explicitly walks first-time users through authentication, omission of basic secret-handling guidance materially increases the chance of credential leakage through source control, shared directories, backups, or logs.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.