yutu: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded secrets, or undisclosed third-party data sharing in the inspected materials. The main concern is operational risk: the README documents destructive actions such as deleting videos, playlists, comments, captions, subscriptions, channel sections, and watermarks. In the inspected docs, we did not see a clearly stated confirmation gate before irreversible actions.

We also found that setup relies on local OAuth credential and token files through `YUTU_CREDENTIAL` and `YUTU_CACHE_TOKEN`, together with broad YouTube OAuth scopes, including full YouTube access and force-SSL scope. That increases the impact if the local environment or tokens are mishandled.

Separately, the documented install method pipes a remote script from `raw.githubusercontent.com` into `bash`. This is disclosed in the README, but it still means executing installer code fetched at runtime.

What to do instead

Use this skill only if you are comfortable reviewing the requested OAuth scopes, managing local token files carefully, and avoiding high-impact actions unless you have your own verification step. Prefer inspecting and downloading installer code before running it, rather than piping it directly to `bash`. If you need safer day-to-day use, choose tooling that clearly documents confirmation prompts for destructive actions and supports narrower permissions.