fit-scorer
Pass
Audited by Gen Agent Trust Hub on Aug 20, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script
youtube.pylocated within its own package directory to retrieve engagement and authenticity metrics for YouTube influencers. This is a standard functional component provided by the author to automate data retrieval. - [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from social platforms and user-provided influencer handles, which represents an indirect prompt injection surface.
- Ingestion points: Influencer handles, profile data, and engagement metrics fetched from YouTube via a connector script.
- Boundary markers: The instructions mandate using the structured templates defined in
references/scoring-templates.md, which helps separate external data from agent instructions. - Capability inventory: The skill uses a subprocess call to run
youtube.pyand writes scoring reports to the local file system atmemory/influencer/fit-scorer/. - Sanitization: The skill does not explicitly mention sanitization of the influencer-provided text data before inclusion in reports.
Audit Metadata