YouTube Video Category

• Outcome: Review
• Latest audit: Sep 12, 2026 · 12:45 AM UTC
• Version: 0.10.7-dev

Overview

This skill is for listing YouTube video categories, but it asks users to install an unpinned third-party CLI and handle persistent YouTube OAuth secrets without enough safety guidance.

Review this skill before installing. Use it only if you are comfortable granting the yutu CLI access to your YouTube account. Keep client_secret.json and youtube.token.json private, do not commit or paste them, avoid raw JSON/base64 secrets in shell exports or CI logs, prefer restrictive file permissions, and verify the yutu package source and version before installation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:35

Finding

Unpinned Third-Party CLI Is Entrusted with YouTube OAuth Credentials

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-20; references/setup.md:35-48,53-56
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable code snippets:

SKILL.md:17-20

yaml

install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

references/setup.md:35-48

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

references/setup.md:53-56

markdown

| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

Technical Analysis

The installation instructions retrieve a third-party executable without pinning an audited version or verifying its integrity. The npm command implicitly selects the registry's current version, while the Go installation explicitly selects @latest. The Homebrew, Winget, and release-binary alternatives also do not document an immutable version, checksum, or signature verification procedure.

This does not prove that the current yutu package is malicious. However, it creates a supply-chain trust boundary in which the code executed by users can change after the Skill itself has been reviewed. A compromised maintainer account, package registry entry, release artifact, or future package version could therefore introduce arbitrary code.

The risk is increased because the installed CLI is instructed to process YUTU_CREDENTIAL and YUTU_CACHE_TOKEN, which may contain an OAuth client secret and a cached YouTube access or refresh token. Global installation also ...[truncated 1466 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin @eat-pray-ai/yutu and the Go module to a specific, reviewed version rather than relying on the current registry version or @latest.
2. Where supported, enforce package integrity using lockfiles, registry integrity hashes, signed provenance, or equivalent package-manager verification.
3. Publish SHA-256 checksums and signature-verification instructions for prebuilt release binaries.
4. Document the verified publisher, repository, and expected package identifiers so users can detect dependency-confusion or impersonation attempts.
5. Test and approve dependency upgrades before changing the pinned version.
6. Request only the minimum OAuth scopes needed for listing video categories and clearly document those scopes before authorization.
7. Determine whether category listing can use an API key or unauthenticated public endpoint; if so, avoid exposing reusable OAuth tokens for this operation.
8. Store token files with restrictive filesystem permissions and avoid passing raw credential JSON or tokens through environments where unrelated processes may inspect them.
9. Recommend installation and execution from a non-privileged account, and warn users not to run the global installation or CLI with unnecessary administrative privileges.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The environment variable documentation explicitly allows OAuth client secrets and cached tokens to be supplied as raw base64 or JSON, which increases the chance that secrets will be exposed through shell history, process listings, CI logs, or environment dumps. In the context of a setup guide, normalizing this pattern without warnings can encourage insecure secret handling.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

| Variable | Description | Default |
|----------|-------------|---------|
| `YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` |
| `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
| `YUTU_ROOT` | Root directory for file resolution | Current working directory |
| `YUTU_LOG_LEVEL` | Log level: `DEBUG`, `INFO`, `WARN`, `ERROR` | `INFO` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The setup guide instructs users to create and store OAuth client secrets and cached access tokens in predictable local files, but it does not warn that these files are sensitive or should be excluded from source control, logs, and shared directories. In a skill that helps users authenticate to YouTube APIs, this omission can lead to accidental credential exposure and unauthorized access to the user's YouTube account or API project.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The documentation states a default --regionCode of US, which imposes a locale-specific behavior unless the user overrides it. The file does not indicate that this default is optional by explicit user choice or justified as region-specific behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.