YouTube Watermark

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 12:49 AM UTC
• Version: 0.10.7-dev

Overview

This skill is a straightforward YouTube watermark helper, but it relies on sensitive YouTube OAuth files and an external CLI that users should verify before use.

Before installing, verify the yutu CLI source and version, avoid running installs with elevated privileges, store client_secret.json and youtube.token.json outside shared or git-tracked folders, restrict their permissions, and confirm the target channel ID before running set or unset commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: references/setup.md:35

Finding

Unpinned Third-Party CLI Installation Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:17-20; references/setup.md:35-50
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code

SKILL.md:17-20:

yaml

install:
  - kind: node
    package: "@eat-pray-ai/yutu"
    bins: [yutu]

references/setup.md:35-50:

bash

# Node.js (all platforms)
npm i -g @eat-pray-ai/yutu

# macOS
brew install yutu

# Linux
brew install yutu

# Windows
winget install yutu

# Gopher
go install github.com/eat-pray-ai/yutu@latest

markdown

Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH.

Technical Analysis

The installation metadata and setup guide direct users to install mutable third-party artifacts without pinning an audited version or immutable commit. In particular:

• The npm package has no exact version.
• The Go command explicitly requests @latest.
• The release link resolves to the latest mutable release.
• No checksum, cryptographic signature, lockfile, or other integrity-verification procedure is supplied for downloaded binaries.
• The Homebrew and Winget instructions do not document the expected formula, manifest source, publisher, or package identity verification.

Package managers provide transport and registry-level controls, but those controls do not protect users if a maintainer account, upstream repository, package release process, registry entry, or distribution manifest is compromised. Global npm installation can also execute package lifecycle behavior with the invoking user's privileges.

The installed CLI is expected to access OAuth client credentials and a cached YouTube authorization token through YUTU_CREDENTIAL, YUTU_CACHE_TOKEN, client_secret.json, and youtube.token.json. Consequently, a malicious substituted dependency would execute in a security-sensitive context.

...[truncated 1680 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the npm package to a specific audited version rather than relying on the registry's current version:

   bash

   npm i -g @eat-pray-ai/yutu@<audited-version>
   

2. Replace @latest in the Go installation command with a specific release tag or immutable commit:

   bash

   go install github.com/eat-pray-ai/yutu@<verified-version-or-commit>
   

3. Link binary downloads to a specific release instead of /releases/latest.
4. Publish SHA-256 or stronger checksums for every supported binary and require users to verify them before installation.
5. Prefer cryptographically signed release artifacts and document signature verification using a trusted, independently distributed public key.
6. Identify the expected Homebrew formula source, Winget package identifier, and verified publisher explicitly.
7. Pin the version in SKILL.md installation metadata if the skill platform supports version constraints or integrity hashes.
8. Review each pinned release before updating it, and automate dependency provenance, signature, and checksum validation.
9. Run the CLI without administrative privileges and grant only the minimum OAuth scopes required for watermark operations.
10. Store OAuth token files with restrictive filesystem permissions and rotate or revoke tokens promptly if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 20)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 25)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/setup.md (reported line 60)May include surrounding context.

md

bins:
        - yutu
      config:
        - client_secret.json
        - youtube.token.json
    primaryEnv: YUTU_CREDENTIAL
    emoji: "\U0001F3AC\U0001F430"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description lists triggers such as "set watermark" and "unset watermark," which are short natural-language phrases that could match ordinary user requests outside a narrowly defined invocation context. The manifest does not provide exclusion conditions, negative examples, or other scope constraints to clarify when the skill should or should not activate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The guide instructs users to download OAuth client secrets and store both the OAuth client file and the cached access token locally, but it does not warn that these files are sensitive, should not be committed to source control, and should be protected with restrictive file permissions. In a skill that manages a YouTube channel, exposed tokens could allow unauthorized API access to the user's channel and account-linked data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This is a real safety/usability issue because the skill describes a command that changes channel-wide watermark settings without clearly warning the user that it performs a persistent modification to YouTube channel configuration. In an agent-driven context, a user may invoke the skill expecting informational help and unintentionally cause branding changes across videos, leading to unwanted operational impact and possible account/content-owner confusion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.