youtube-watermark
Pass
Audited by Gen Agent Trust Hub on Mar 16, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes the
yutuCLI to manage YouTube watermarks through the YouTube Data API. - [EXTERNAL_DOWNLOADS]: Installation instructions reference the
@eat-pray-ai/yutuNPM package and theeat-pray-ai/yutuGitHub repository, which are official resources from the skill author. - [CREDENTIALS_UNSAFE]: The skill requires YouTube API access via OAuth credentials and tokens stored in local files (
client_secret.json,youtube.token.json) or environment variables (YUTU_CREDENTIAL,YUTU_CACHE_TOKEN). - [PROMPT_INJECTION]: The skill incorporates user-supplied parameters, such as channel IDs and file paths, directly into CLI commands, which constitutes an indirect prompt injection surface. Ingestion points: Parameters like
--channelIdand--filein the operation reference files. Boundary markers: No explicit markers or delimiters are used in the command templates. Capability inventory: The skill executes subprocesses via theyutubinary. Sanitization: No input validation or sanitization logic is explicitly detailed in the documentation.
Audit Metadata