youtube
Pass
Audited by Gen Agent Trust Hub on Sep 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads video files from a vendor-associated CDN (
example.cdn.acedata.cloud) as part of its upload workflow. This allows the agent to process videos generated by external services. - [COMMAND_EXECUTION]: The skill utilizes
Bashto performcurlrequests to official Google API endpoints and processes the results withjq. It also performs local file management usingmktempandrmfor temporary video storage, which is consistent with its stated functionality. - [INDIRECT_PROMPT_INJECTION]: The skill possesses an ingestion surface as it reads data from YouTube API responses (such as comments and video descriptions) and external URLs.
- Ingestion points: Data enters the context via
https://www.googleapis.com/youtube/v3/*endpoints and the provided CDN source URL. - Boundary markers: No specific delimiters are used for text data, but binary data is validated.
- Capability inventory: The skill can execute shell commands via the
Bashtool and record results usingpublish_artifact. - Sanitization: The skill includes a check to ensure downloaded video content is not an HTML page, which prevents certain types of data injection or processing errors.
Audit Metadata