YouTube Channel

Manage YouTube channels. Use this skill to list or update channels. Useful when working with YouTube channel — provides commands to list and update channel v...

Security Scan

The skill is internally consistent: it documents a CLI (yutu) for managing YouTube channels and only asks for the OAuth credentials, token files, and the yutu binary that such a tool legitimately needs.

Purpose & Capability

Name/description (YouTube channel management) align with required binary (yutu), the declared env vars (OAuth credential and cached token), and the declared config files (client_secret.json, youtube.token.json). These are expected for a YouTube API CLI.

Instruction Scope

SKILL.md instructs the agent to run the yutu CLI and to perform OAuth auth that opens a browser and saves a token locally. It does not instruct reading unrelated system files or exfiltrating data to third-party endpoints beyond Google's OAuth flow.

Install Mechanism

Install spec uses an npm package (@eat-pray-ai/yutu) which is a reasonable delivery mechanism for a CLI. Installing code from a public package registry carries normal supply-chain risk — verify the package publisher and GitHub releases. SKILL.md also documents alternate install methods (brew, winget, go), while the registry install entry lists only the node package; this minor inconsistency is not a security red flag but worth noting.

Credentials

Only YUTU_CREDENTIAL and YUTU_CACHE_TOKEN are required (primaryEnv is the OAuth credential). These variables map directly to the declared purpose. Other optional environment variables are documented but not required. No unrelated service credentials are requested.

Persistence & Privilege

always is false (default) and model invocation is allowed (platform default). The skill does not request elevated or persistent platform-wide privileges. It requires storing an OAuth token locally (standard for API clients).

Assessment

This skill appears to do what it says: it wraps the yutu CLI to list and update YouTube channels. Before installing, verify the @eat-pray-ai/yutu package and GitHub repo are legitimate (check publisher, release artifacts, and recent activity). Keep client_secret.json and youtube.token.json private — they are sensitive OAuth credentials/tokens. If you plan to install the npm package, prefer installing from the official GitHub releases or the package registry over arbitrary binaries, and consider reviewing the package source if you don't trust the publisher. Finally, be aware that the CLI will open a browser for OAuth consent and will write a token file locally; rotate credentials if you suspect misuse.

Manage YouTube channels. Use this skill to list or update channels.

Before You Begin

yutu requires Google Cloud Platform OAuth credentials and a cached token to access the YouTube API. If you haven't set up yutu yet, read the setup guide first.

Operations

Read the linked reference for full flag details and examples.

Operation	Description	Reference
list	List channel information	details
update	Update channel information	details

Quick Start

# Show all channel commands
yutu channel --help

# List channel
yutu channel list