tubescribe
Warn
Audited by Snyk on Apr 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.80). Yes — the skill explicitly fetches public YouTube content (captions/transcripts, metadata and viewer comments) via summarize/yt-dlp and HTML scraping (see scripts/tubescribe.py and SKILL.md), and the agent/sub-agent reads and uses that untrusted, user-generated content as part of its processing pipeline to produce summaries, quotes, documents and audio.
Issues (1)
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata