YouTube Member
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This is a coherent YouTube member-listing skill, but it requires Google/YouTube OAuth credentials and installation of an external yutu CLI, so users should authorize and install it carefully.
Before installing, make sure you trust the yutu CLI source, understand the Google OAuth permissions you grant, and keep the credential and token files private. The documented skill behavior is limited to listing YouTube channel members and does not show hidden mutation or exfiltration behavior in the provided artifacts.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone or anything that can use the configured token may be able to access YouTube account data allowed by the OAuth consent.
The skill relies on a persistent OAuth token for YouTube API access. This is necessary for the stated purpose, but it grants delegated access to the user's YouTube account.
A browser window will open for you to grant YouTube access. After granting permission, a token is saved to `youtube.token.json`.
Use a dedicated Google Cloud OAuth client, grant only the scopes needed by yutu, keep `client_secret.json` and `youtube.token.json` private, and revoke the token if you stop using the skill.
Installing the external CLI gives that software local execution capability and access to the OAuth credentials configured for yutu.
The skill depends on installing an external CLI from package managers, source, or prebuilt releases. This is disclosed and aligned with the skill's purpose, but the installed tool is outside the instruction-only artifact set.
npm i -g @eat-pray-ai/yutu ... go install github.com/eat-pray-ai/yutu@latest ... Download a prebuilt binary from the releases page
Install yutu only from the official package or repository you trust, prefer pinned or verified versions when possible, and review the upstream project before authorizing account access.