youtube-stats
Pass
Audited by Gen Agent Trust Hub on Nov 8, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
uv runto execute a local Python scripttools/youtube_stats.py. This script is the primary tool for fetching and reporting channel statistics. - [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, specifically YouTube video metadata and GitHub referrer information, which are then presented to the agent for analysis.
- Ingestion points: Data is ingested via the YouTube Data/Analytics APIs and GitHub traffic APIs into the local script's output.
- Boundary markers: None are present in the provided instructions to separate external data from agent instructions.
- Capability inventory: The skill has the capability to execute local scripts and perform network operations via the Python environment.
- Sanitization: There is no mention of sanitization or escaping for external strings such as video titles or referrer URLs before they are processed by the agent.
Audit Metadata