youtube-clip-finder
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill provides templates for shell commands using
yt-dlpto download specific sections of YouTube videos. These commands are generated by the agent and may be executed upon user request. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources and interpolates it into sensitive contexts.
- Ingestion points: Video metadata (titles, channel names) and transcript text are retrieved from the
arcmira.searchandarcmira.transcriptfunctions inSKILL.md. - Boundary markers: There are no explicit delimiters or instructions to prevent the agent from following malicious commands that could be embedded within transcript caption data.
- Capability inventory: The skill possesses the capability to generate shell commands and return them to the user or execute them via the agent's environment.
- Sanitization: The
video_idvariable and transcript text are interpolated directly into shell command strings and URL patterns without validation or escaping beyond basic type coercion. - [EXTERNAL_DOWNLOADS]: The skill refers the user to the official GitHub repository for the
yt-dlputility for installation instructions. This points to a well-known and established public software repository.
Audit Metadata