The Agent Skills Directory

[DYNAMIC_EXECUTION]: The skill includes a parameter named customMapFunction, which is defined as a "JavaScript function to transform each output object." This allows for the execution of arbitrary JavaScript code within the context of the scraping tool. While intended for data processing, it provides a surface for the execution of generated or untrusted logic.
[COMMAND_EXECUTION]: The instructions recommend running a local script via node scripts/run_actor.js to handle data processing and output saving. Because this script is referenced but its source code is not provided in the skill package, its behavior and the safety of its handling of arguments or outputs cannot be verified.
[INDIRECT_PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to its handling of untrusted external content.
Ingestion points: YouTube video titles and descriptions are scraped using the apidojo/youtube-scraper actor (SKILL.md).
Boundary markers: No explicit delimiters or instructions are provided to the agent to disregard instructions embedded within the retrieved data.
Capability inventory: The skill allows shell command execution via node and curl, and file system writes for saving results.
Sanitization: The skill lacks clear sanitization or validation logic for the scraped text before it is used to score sponsorship fit or formatted into the final output report.
[DATA_EXFILTRATION]: The skill communicates with api.apify.com via curl and the apify:run-actor tool to perform scraping tasks. These operations require an APIFY_TOKEN and involve transmitting search parameters to an external service. While Apify is a well-known service, the interaction involves the transmission of sensitive API credentials and search queries to a remote environment.

finding-youtube-sponsorship-candidates