youtube-influencer-finder-api-skill
Pass
Audited by Gen Agent Trust Hub on Sep 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script (
scripts/youtube_influencer_finder_api.py) to perform API requests and process data. This is a standard execution pattern for this type of skill. - [EXTERNAL_DOWNLOADS]: The Python script makes network requests to
api.browser-act.comto initiate tasks and retrieve results. This domain is owned by the skill's vendor and is used as expected for the skill's stated purpose. - [INDIRECT_PROMPT_INJECTION]: The skill retrieves and processes unstructured content from YouTube (such as channel descriptions and profile bios) which is controlled by third-party creators.
- Ingestion points: External data is ingested in
scripts/youtube_influencer_finder_api.pyvia thetask_info.get("output", {}).get("string")call. - Boundary markers: The instructions do not define specific delimiters or instructions to the agent to treat the retrieved profile data as untrusted content.
- Capability inventory: The skill has the capability to execute shell commands (running the script) and perform network operations to the vendor API.
- Sanitization: The script prints the raw output from the API to the agent's context without filtering or sanitizing potential instruction-like text embedded in the YouTube descriptions.
Audit Metadata