video2ctx-api
Warn
Audited by Gen Agent Trust Hub on Aug 18, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to install the
@video2ctx/clipackage globally from the public npm registry. - [COMMAND_EXECUTION]: The agent is directed to use shell commands for package installation (
npm install --global) and for executing data retrieval tasks (video2ctx). - [REMOTE_CODE_EXECUTION]: By installing and running a global CLI tool, the skill executes code from a remote source on the host system.
- [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes external content such as YouTube transcripts and comments which can be controlled by third parties. 1. Ingestion points: Transcripts and comments retrieved via the
video2ctx transcriptandvideo2ctx apicommands. 2. Boundary markers: No explicit delimiters or safety instructions are provided to the agent for handling the retrieved content. 3. Capability inventory: The agent has the ability to execute shell commands and install software globally. 4. Sanitization: There is no evidence of sanitization or filtering of the external data before processing.
Audit Metadata