discovering-viral-youtube-videos-by-category
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using
nodeto run a local script (scripts/run_actor.js) andcurlto interact with the Apify REST API. These are standard operations for the skill's intended purpose of data retrieval. - [DYNAMIC_EXECUTION]: The
customMapFunctionparameter allows for a JavaScript function to be passed as a string to the Apify actor. This code is executed on the remote Apify platform for data transformation. While this is an intended feature of the vendor's service, it involves the dynamic assembly of executable code. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from YouTube, which could potentially contain malicious instructions intended to influence the agent's behavior.
- Ingestion points: Video metadata such as titles, keywords, and descriptions are fetched from YouTube via the
apidojo~youtube-trending-scraperactor inSKILL.md. - Boundary markers: No explicit delimiters or instructions to ignore embedded directives within the YouTube data are provided.
- Capability inventory: The skill can execute local scripts via
nodeand perform network operations viacurl. - Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the agent.
Audit Metadata