scraping-youtube-videos-by-keyword
Pass
Audited by Gen Agent Trust Hub on Sep 2, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill documentation describes a
customMapFunctioninput parameter that accepts a JavaScript function as a string to transform output objects. This creates a surface for dynamic code execution. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted external data from YouTube, including video titles and descriptions, which could contain malicious instructions aimed at the agent processing the results.
- Ingestion points: Fetches YouTube metadata (titles, descriptions, channel names) from the Apify actor dataset.
- Boundary markers: None identified; instructions do not specify the use of delimiters when presenting scraped data to the agent.
- Capability inventory: Uses network operations (curl), executes local scripts (node), and supports file system writes (--output results.csv).
- Sanitization: No sanitization or filtering of the scraped content is mentioned before it is returned to the user or agent.
Audit Metadata