scraping-youtube-channel-data
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute shell commands using
nodeto run a local script (scripts/run_actor.js) andcurlto interact with the Apify REST API. - [DYNAMIC_EXECUTION]: The skill exposes a
customMapFunctionparameter, which allows for the provision of a JavaScript function as a string. This code is intended to be executed on the remote Apify platform for data transformation. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process untrusted metadata from YouTube channels and videos, which could contain malicious instructions.
- Ingestion points: YouTube channel descriptions, video titles, and other metadata fields returned by the scraper.
- Boundary markers: None are specified in the instructions to separate scraped content from agent instructions.
- Capability inventory: The agent has the ability to execute shell commands (
node,curl) and write data to the local file system using the--outputflag in the provided script examples. - Sanitization: There is no evidence of sanitization or filtering of the scraped content before it is processed or displayed by the agent.
Audit Metadata