tubescribe

Pass

Audited by Gen Agent Trust Hub on Apr 16, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATION
Full Analysis
  • [COMMAND_EXECUTION]: The main script invokes external command-line tools including ffmpeg, pandoc, and yt-dlp to perform audio conversion, document generation, and metadata retrieval. Arguments are sanitized through domain validation and filename normalization. Ephemeral Python scripts are also executed to interface with TTS engines, using JSON-based escaping to prevent injection.\n- [EXTERNAL_DOWNLOADS]: The setup script facilitates the installation of necessary tools by downloading verified binaries from official GitHub releases (e.g., jgm/pandoc and yt-dlp/yt-dlp). These operations are well-documented and target established, trusted sources.\n- [DATA_EXFILTRATION]: Communication with external servers is restricted to retrieving YouTube content (metadata, transcripts, and comments) as requested by the user. No sensitive user data or credentials are transmitted or exposed to non-whitelisted domains.\n- [PROMPT_INJECTION]: The skill employs a sub-agent architecture with strict operational constraints defined in SKILL.md, explicitly forbidding the execution of software installers or unauthorized network operations.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 16, 2026, 05:28 PM
Security Audit — agent-trust-hub — tubescribe