video-watch

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The Microsoft Learn links are official and low-risk, but the GitHub repository (aktsmm/speech-translator-desktop-plus) is a third‑party/personal project (potentially distributing release binaries from an individual account) and should be treated as a potentially suspicious download source unless you verify the repo, its releases, and vendor trust.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In scripts/video_watch.py, when the required workflow is run on a user-supplied --source URL it uses yt-dlp to extract captions/subtitles and then Copilot reads the resulting first-party-created run_dir/transcript.md artifact at runtime, so outsider-authored free text can be ingested via the captions provided by the video URL.