YouTube Video

• Outcome: Review
• Latest audit: Sep 11, 2026 · 11:41 PM UTC
• Version: 0.10.7-dev

Overview

This skill is a coherent YouTube management helper, but it enables credentialed uploads, updates, ratings, reports, and deletion with weak scoping and unpinned CLI installation.

Review this skill before installing. Use a pinned and verified yutu release where possible, protect OAuth credential and token files, keep them out of repositories and prompts, and require explicit confirmation before running upload, update, delete, rate, or report commands. Prefer private uploads and disabled subscriber notifications unless you intentionally want public publication.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: references/setup.md:35
• Finding: Unpinned Third-Party CLI Installation Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:21-25`; `references/setup.md:35-54` **Vulnerability Type**: Unpinned executable dependency and unverified binary installation **Risk Level**: High ### Vulnerable Code `SKILL.md:21-25` ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:35-54` ```bash ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ``` ```markdown ### Other platforms Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH. ``` ### Technical Analysis The skill directs users or agents to install and execute the third-party `yutu` CLI without pinning a reviewed version. In particular: - The npm package declaration and `npm i -g` command resolve a mutable package version. - The Go installation explicitly uses the mutable `@latest` reference. - The prebuilt binary instructions use the mutable `/releases/latest` URL. - No cryptographic checksum, signature, provenance attestation, lockfile, or trusted artifact digest is supplied. - The Homebrew and WinGet commands do not identify a reviewed version or document package-source verification. This creates a supply-chain trust boundary in which code that was not present during this audit can later be installed and executed. The risk is elevated because the CLI is given access to Google OAuth client credentials and a cached YouTube authorization token. According to the documented operations, it can upload, update, delete, rate, and report videos. This finding does not establish that the current upstream package is malicious. The vulnerability is the use of mutable, unverified executable dependencies for a credentialed and potentially d ...[truncated 1826 chars]
• Remediation: ## Remediation Suggestions 1. Pin `@eat-pray-ai/yutu` and the Go module to an explicitly reviewed release rather than using an implicit current version or `@latest`. 2. Record and verify SHA-256 or stronger digests for downloaded binaries before execution. 3. Prefer signed releases and verify signatures against a documented, independently distributed maintainer key. 4. Use registry provenance or software attestations where available, and document the exact trusted Homebrew tap and WinGet package identity. 5. Replace `/releases/latest` links with immutable, versioned artifact URLs. 6. Avoid automatic global installation by an agent. Require explicit user approval before installing or upgrading executable dependencies. 7. Run the CLI with least privilege in an isolated environment, without unrelated home-directory files or secrets. 8. Request only the minimum Google OAuth scopes required for the selected operation. 9. Store token and credential files with restrictive filesystem permissions and keep them outside shared working directories. 10. Establish a controlled upgrade process that reviews release changes, verifies artifacts, tests the pinned version, and updates expected hashes before deployment. 11. Document token revocation and rotation procedures for suspected package or host compromise.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The trigger list uses very broad natural-language phrases such as 'delete video' and 'upload a video' without any scoping, confirmation, or ownership constraints. In an agent setting, this increases the chance of accidental invocation of sensitive actions, including deletion or modification of YouTube content, especially when user intent is ambiguous.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill advertises destructive and privacy-impacting operations like delete, reportAbuse, update, and rating changes without warning users about side effects or irreversibility. This makes misuse or accidental harm more likely, particularly in agent-driven workflows where users may not realize an action mutates account state or affects public content.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The setup guide instructs users to download an OAuth client secret and creates a cached OAuth token, but it does not warn that both files are sensitive and should be protected from source control, sharing, or broad filesystem access. In a skill intended for CLI/API use, this omission can lead to credential leakage and unauthorized access to the user's YouTube account or API project.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation exposes a destructive delete operation with concrete examples but provides no warning about irreversibility, confirmation expectations, or guidance to verify target video IDs before execution. In an agent skill context, concise command-oriented docs can be executed or suggested with little scrutiny, increasing the chance of accidental permanent deletion of user content.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation encourages video upload actions without clearly warning that subscriber notifications are enabled by default and that users may choose public visibility. In an agent-driven context, this increases the risk of unintended publication, accidental audience notification, and disclosure of sensitive or unfinished content through normal-looking command usage.

Static analysis

No suspicious patterns detected.