skills/ericosiu/ai-marketing-skills/yt-competitive-analysis/Snyk

yt-competitive-analysis

Fail

Audited by Snyk on Sep 16, 2026

Risk Level: HIGH

Full Analysis

HIGH W007: Insecure credential handling detected in skill instructions.

Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to pass the YouTube API key as a command-line argument ($YOUTUBE_API_KEY) in python scripts, exposing the credential value in the generated execution commands.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (low risk: 0.10). The workflow fetches video titles and metadata from YouTube channels via the YouTube Data API, where video titles can contain outsider-authored free text.

Issues (2)

W007

HIGH

Insecure credential handling detected in skill instructions.

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

HIGH

Analyzed

Sep 16, 2026, 07:13 PM

Issues

2