yt-empire-publisher
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill documentation references running
npx notebooklm-mcp@latest, which retrieves external code from the npm registry.\n- [REMOTE_CODE_EXECUTION]: Executing packages vianpxinvolves running remote code on the local environment.\n- [COMMAND_EXECUTION]: The skill uses shell commands to run Python scripts and the npx package manager.\n- [INDIRECT_PROMPT_INJECTION]: The skill ingests video titles and descriptions which are often generated from external data, creating a surface for indirect instructions.\n - Ingestion points: Video title and description arguments in the upload command (SKILL.md).\n
- Boundary markers: None identified in the provided CLI example.\n
- Capability inventory: Local file access and network access via YouTube Data API.\n
- Sanitization: No sanitization logic is documented.
Audit Metadata