cross-niche-outliers
Pass
Audited by Gen Agent Trust Hub on Oct 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADS
Full Analysis
- [COMMAND_EXECUTION]: The script
scripts/scrape_cross_niche_outliers.pyusessubprocess.runto execute theyt-dlpcommand-line utility for scraping YouTube video metadata. - Evidence: Found in
scrape_keyword,scrape_channel, andget_channel_averagefunctions using thesubprocess.run()method with arguments passed as a list. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data (YouTube video titles and transcripts) by passing them directly into Claude API prompts for summarization and title variant generation without explicit boundary markers or sanitization instructions.
- Ingestion points: Video titles and transcripts fetched from YouTube via
yt-dlp,youtube-transcript-api, and Apify. - Boundary markers: None detected; variables are interpolated directly into f-string prompts in
summarize_transcriptandgenerate_title_variantswithinscripts/scrape_cross_niche_outliers.pyandscripts/scrape_cross_niche_tubelab.py. - Capability inventory: The agent has the capability to write data to Google Sheets via
gspreadand the Google Sheets API. - Sanitization: No specific filtering or escaping of content found before interpolation into LLM prompts.
- [EXTERNAL_DOWNLOADS]: The skill fetches content from external sources to perform its primary function.
- Fetches video metadata from YouTube using
yt-dlp. - Fetches video transcripts using
youtube-transcript-apiand the Apifykaramelo/youtube-transcriptsactor.
Audit Metadata