yt-competitive-analysis
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONDATA_EXFILTRATION
Full Analysis
- [SAFE]: The skill is implemented using only the Python standard library, eliminating risks associated with third-party dependency supply chains.
- [DATA_EXFILTRATION]: The script communicates with official Google API endpoints (
googleapis.com) to retrieve YouTube video data. This network activity is a documented requirement for the tool's primary function and targets a well-known, trusted service. - [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data in the form of YouTube video titles and channel descriptions.
- Ingestion points: Video metadata is fetched via the YouTube Data API in
analyze.py. - Boundary markers: No specific delimiters or safety instructions are provided to the agent regarding the processing of this external content.
- Capability inventory: The skill is limited to performing network reads and displaying data to the console; it lacks dangerous capabilities such as local file writing or arbitrary code execution.
- Sanitization: Fetched video titles and statistics are processed and displayed without sanitization.
- [SAFE]: The skill follows secure practices for handling API keys by using environment variables or command-line arguments, as outlined in the setup documentation.
Audit Metadata