youtube-video
Pass
Audited by Gen Agent Trust Hub on Mar 26, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: Fetches the yutu CLI tool from the official npm registry (@eat-pray-ai/yutu) and provides instructions for installation via Homebrew, Winget, or Go from the author's GitHub repository.
- [COMMAND_EXECUTION]: Uses the yutu command-line utility to perform authenticated requests to the YouTube Data API for video management tasks.
- [PROMPT_INJECTION]: The skill processes external content such as video titles and descriptions returned by the YouTube API, which represents a surface for indirect prompt injection. * Ingestion points: Video metadata retrieved through yutu video list and yutu video getRating commands in references/video-list.md and references/video-getRating.md. * Boundary markers: No specific delimiters or instructions to ignore embedded commands are present in the prompt templates. * Capability inventory: The skill has the ability to execute shell commands to modify or delete YouTube resources across all reference files. * Sanitization: No explicit sanitization of the retrieved video metadata is performed before it is processed by the agent.
Audit Metadata