discovering-viral-youtube-videos-by-category

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFECOMMAND_EXECUTIONDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using node to run a local script (scripts/run_actor.js) and curl to interact with the Apify REST API. These are standard operations for the skill's intended purpose of data retrieval.
  • [DYNAMIC_EXECUTION]: The customMapFunction parameter allows for a JavaScript function to be passed as a string to the Apify actor. This code is executed on the remote Apify platform for data transformation. While this is an intended feature of the vendor's service, it involves the dynamic assembly of executable code.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted external data from YouTube, which could potentially contain malicious instructions intended to influence the agent's behavior.
  • Ingestion points: Video metadata such as titles, keywords, and descriptions are fetched from YouTube via the apidojo~youtube-trending-scraper actor in SKILL.md.
  • Boundary markers: No explicit delimiters or instructions to ignore embedded directives within the YouTube data are provided.
  • Capability inventory: The skill can execute local scripts via node and perform network operations via curl.
  • Sanitization: There is no evidence of sanitization or filtering of the external content before it is processed by the agent.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 07:12 PM
Security Audit — agent-trust-hub — discovering-viral-youtube-videos-by-category