mrbeast-perspective

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's SKILL.md Agentic Protocol Step 2 explicitly requires using WebSearch and other tools to fetch open web content (industry benchmarks, competitor videos, trends) and the included script fetch_youtube_subtitles.sh downloads subtitles from arbitrary YouTube URLs, so the agent will ingest untrusted public third‑party content that can materially influence its decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The skill includes a runtime script (scripts/fetch_youtube_subtitles.sh) that downloads remote subtitle content from user-supplied YouTube URLs (e.g., https://youtube.com/watch?v=...) which can be injected into the agent's analysis/model context, and the script will also run pip install yt-dlp if missing (fetching/executing remote code), so this is a runtime external dependency that can control inputs and execute remote-fetched code.