YouTube Video Category

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:45 AM UTC
• Version: 0.10.7-dev

Overview

This skill is for listing YouTube video categories, but it asks users to install an unpinned third-party CLI and handle persistent YouTube OAuth secrets without enough safety guidance.

Review this skill before installing. Use it only if you are comfortable granting the yutu CLI access to your YouTube account. Keep client_secret.json and youtube.token.json private, do not commit or paste them, avoid raw JSON/base64 secrets in shell exports or CI logs, prefer restrictive file permissions, and verify the yutu package source and version before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:35
• Finding: Unpinned Third-Party CLI Is Entrusted with YouTube OAuth Credentials## Vulnerability Details **File Location**: `SKILL.md:17-20`; `references/setup.md:35-48,53-56` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium **Vulnerable code snippets:** `SKILL.md:17-20` ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:35-48` ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` `references/setup.md:53-56` ```markdown | `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` | | `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` | | `YUTU_ROOT` | Root directory for file resolution | Current working directory | | `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` | ``` ### Technical Analysis The installation instructions retrieve a third-party executable without pinning an audited version or verifying its integrity. The npm command implicitly selects the registry's current version, while the Go installation explicitly selects `@latest`. The Homebrew, Winget, and release-binary alternatives also do not document an immutable version, checksum, or signature verification procedure. This does not prove that the current `yutu` package is malicious. However, it creates a supply-chain trust boundary in which the code executed by users can change after the Skill itself has been reviewed. A compromised maintainer account, package registry entry, release artifact, or future package version could therefore introduce arbitrary code. The risk is increased because the installed CLI is instructed to process `YUTU_CREDENTIAL` and `YUTU_CACHE_TOKEN`, which may contain an OAuth client secret and a cached YouTube access or refresh token. Global installation also ...[truncated 1466 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@eat-pray-ai/yutu` and the Go module to a specific, reviewed version rather than relying on the current registry version or `@latest`. 2. Where supported, enforce package integrity using lockfiles, registry integrity hashes, signed provenance, or equivalent package-manager verification. 3. Publish SHA-256 checksums and signature-verification instructions for prebuilt release binaries. 4. Document the verified publisher, repository, and expected package identifiers so users can detect dependency-confusion or impersonation attempts. 5. Test and approve dependency upgrades before changing the pinned version. 6. Request only the minimum OAuth scopes needed for listing video categories and clearly document those scopes before authorization. 7. Determine whether category listing can use an API key or unauthenticated public endpoint; if so, avoid exposing reusable OAuth tokens for this operation. 8. Store token files with restrictive filesystem permissions and avoid passing raw credential JSON or tokens through environments where unrelated processes may inspect them. 9. Recommend installation and execution from a non-privileged account, and warn users not to run the global installation or CLI with unnecessary administrative privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

| Variable | Description | Default |
|----------|-------------|---------|
| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

• Confidence: 80% confidence
• Finding: The environment variable documentation explicitly allows OAuth client secrets and cached tokens to be supplied as raw base64 or JSON, which increases the chance that secrets will be exposed through shell history, process listings, CI logs, or environment dumps. In the context of a setup guide, normalizing this pattern without warnings can encourage insecure secret handling.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup guide instructs users to create and store OAuth client secrets and cached access tokens in predictable local files, but it does not warn that these files are sensitive or should be excluded from source control, logs, and shared directories. In a skill that helps users authenticate to YouTube APIs, this omission can lead to accidental credential exposure and unauthorized access to the user's YouTube account or API project.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: The documentation states a default `--regionCode` of `US`, which imposes a locale-specific behavior unless the user overrides it. The file does not indicate that this default is optional by explicit user choice or justified as region-specific behavior.

Static analysis

No suspicious patterns detected.