scraping-youtube-channel-info
Warn
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: MEDIUMDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documentation includes a
customMapFunctioninput parameter. This allows for the submission of a JavaScript function as a string to transform the scraper's output. Although this code is executed on the external service's infrastructure, it represents a dynamic execution vector where logic is defined at runtime through input parameters. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and return metadata from YouTube, which is an untrusted external source.
- Ingestion points: Data is pulled from YouTube channel descriptions, names, and keywords based on user-provided URLs or handles.
- Boundary markers: The instructions do not specify any delimiters or safety markers to wrap the retrieved content.
- Capability inventory: The skill facilitates network requests to the Apify API and returns raw data for downstream processing by an agent.
- Sanitization: There is no evidence of sanitization or filtering of the retrieved YouTube metadata before it is returned to the agent context.
- [COMMAND_EXECUTION]: The documentation provides examples of shell commands using
nodeandcurlto trigger the scraping actor. These examples include the use of shell environment variables (e.g.,$APIFY_TOKEN) for authentication and specific command-line arguments to format and save output.
Audit Metadata