YouTube Super Chat Event
Security checks across static analysis, malware telemetry, and agentic risk
Overview
This skill appears to be a purpose-aligned, read-only YouTube Super Chat listing helper, but it requires trusting an external yutu CLI and using YouTube OAuth credentials.
Before installing, make sure you trust the yutu CLI package and understand which YouTube account you are authorizing. Store client_secret.json and youtube.token.json securely, avoid sharing those files or environment variable values, and revoke the OAuth token when it is no longer needed.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If installed and configured, the agent can use the yutu CLI to retrieve Super Chat event data from the authenticated YouTube account.
The skill requires a YouTube OAuth client secret and cached OAuth token to access the YouTube API. This is aligned with listing Super Chat events, but it gives the CLI delegated access to the user's YouTube account data.
`YUTU_CREDENTIAL` | Path, base64, or JSON of OAuth client secret | `client_secret.json` | | `YUTU_CACHE_TOKEN` | Path, base64, or JSON of cached OAuth token | `youtube.token.json` |
Use the least-privileged Google/YouTube authorization available, keep client_secret.json and youtube.token.json private, and revoke the token if you stop using the skill.
Installing the required CLI gives that external package access to the configured YouTube OAuth files when commands are run.
The skill depends on an external CLI package that is not included in the artifact contents. This is expected for a CLI wrapper skill, but the package should be trusted because it will handle OAuth credentials and YouTube API calls.
node | package: @eat-pray-ai/yutu | creates binaries: yutu
Verify the yutu package source and publisher before installing, and prefer a pinned or trusted release where possible.