Security audit

YouTube Watermark

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward YouTube watermark helper, but it relies on sensitive YouTube OAuth files and an external CLI that users should verify before use.

Before installing, verify the yutu CLI source and version, avoid running installs with elevated privileges, store client_secret.json and youtube.token.json outside shared or git-tracked folders, restrict their permissions, and confirm the target channel ID before running set or unset commands.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/setup.md:35
Finding: Unpinned Third-Party CLI Installation Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md:17-20`; `references/setup.md:35-50` **Vulnerability Type**: T08: Insecure Dependencies **Risk Level**: Medium ### Vulnerable Code `SKILL.md:17-20`: ```yaml install: - kind: node package: "@eat-pray-ai/yutu" bins: [yutu] ``` `references/setup.md:35-50`: ```bash # Node.js (all platforms) npm i -g @eat-pray-ai/yutu # macOS brew install yutu # Linux brew install yutu # Windows winget install yutu # Gopher go install github.com/eat-pray-ai/yutu@latest ``` ```markdown Download a prebuilt binary from the [releases page](https://github.com/eat-pray-ai/yutu/releases/latest) and place it in your PATH. ``` ### Technical Analysis The installation metadata and setup guide direct users to install mutable third-party artifacts without pinning an audited version or immutable commit. In particular: - The npm package has no exact version. - The Go command explicitly requests `@latest`. - The release link resolves to the latest mutable release. - No checksum, cryptographic signature, lockfile, or other integrity-verification procedure is supplied for downloaded binaries. - The Homebrew and Winget instructions do not document the expected formula, manifest source, publisher, or package identity verification. Package managers provide transport and registry-level controls, but those controls do not protect users if a maintainer account, upstream repository, package release process, registry entry, or distribution manifest is compromised. Global npm installation can also execute package lifecycle behavior with the invoking user's privileges. The installed CLI is expected to access OAuth client credentials and a cached YouTube authorization token through `YUTU_CREDENTIAL`, `YUTU_CACHE_TOKEN`, `client_secret.json`, and `youtube.token.json`. Consequently, a malicious substituted dependency would execute in a security-sensitive context. ...[truncated 1680 chars]
Remediation: ## Remediation Suggestions 1. Pin the npm package to a specific audited version rather than relying on the registry's current version: ```bash npm i -g @eat-pray-ai/yutu@<audited-version> ``` 2. Replace `@latest` in the Go installation command with a specific release tag or immutable commit: ```bash go install github.com/eat-pray-ai/yutu@<verified-version-or-commit> ``` 3. Link binary downloads to a specific release instead of `/releases/latest`. 4. Publish SHA-256 or stronger checksums for every supported binary and require users to verify them before installation. 5. Prefer cryptographically signed release artifacts and document signature verification using a trusted, independently distributed public key. 6. Identify the expected Homebrew formula source, Winget package identifier, and verified publisher explicitly. 7. Pin the version in `SKILL.md` installation metadata if the skill platform supports version constraints or integrity hashes. 8. Review each pinned release before updating it, and automate dependency provenance, signature, and checksum validation. 9. Run the CLI without administrative privileges and grant only the minimum OAuth scopes required for watermark operations. 10. Store OAuth token files with restrictive filesystem permissions and rotate or revoke tokens promptly if dependency compromise is suspected.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

Category: Privilege Escalation
Content: bins: - yutu config: - client_secret.json - youtube.token.json primaryEnv: YUTU_CREDENTIAL emoji: "\U0001F3AC\U0001F430"
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The description lists triggers such as "set watermark" and "unset watermark," which are short natural-language phrases that could match ordinary user requests outside a narrowly defined invocation context. The manifest does not provide exclusion conditions, negative examples, or other scope constraints to clarify when the skill should or should not activate.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The guide instructs users to download OAuth client secrets and store both the OAuth client file and the cached access token locally, but it does not warn that these files are sensitive, should not be committed to source control, and should be protected with restrictive file permissions. In a skill that manages a YouTube channel, exposed tokens could allow unauthorized API access to the user's channel and account-linked data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: This is a real safety/usability issue because the skill describes a command that changes channel-wide watermark settings without clearly warning the user that it performs a persistent modification to YouTube channel configuration. In an agent-driven context, a user may invoke the skill expecting informational help and unintentionally cause branding changes across videos, leading to unwanted operational impact and possible account/content-owner confusion.

Static analysis

No suspicious patterns detected.