youtube
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches and executes the official
@useclawlink/clipackage from the NPM registry. This tool is provided by the vendor clawlink-hq to facilitate YouTube interactions. - [COMMAND_EXECUTION]: Executes shell commands via
npxto perform authentication and YouTube management tasks, including potentially destructive actions like deleting playlists. - [INDIRECT_PROMPT_INJECTION]: User-provided natural language intent is interpolated into a CLI command, which could potentially be manipulated.
- Ingestion points: The user intent string in the command
npx @useclawlink/cli actions youtube "<what you want to do>"inSKILL.md. - Boundary markers: The intent string is enclosed in double quotes.
- Capability inventory: Includes capabilities to list, create, update, and delete YouTube videos, playlists, and comments.
- Sanitization: No explicit sanitization or validation of the input string is performed within the skill instructions.
Audit Metadata