youtube-api
Pass
Audited by Gen Agent Trust Hub on Aug 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill performs network requests to the vendor's API at
https://youtube.fetcher.shto retrieve YouTube data. These operations are standard for the skill's purpose and target the vendor's infrastructure.- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted content from YouTube, creating a surface for potential indirect prompt injection attacks where malicious instructions could be embedded in metadata or comments. - Ingestion points: YouTube video descriptions, search results, and comments fetched via
/api/video/{id}/commentsand other endpoints. - Boundary markers: No specific delimiters or instructions for the agent to ignore embedded commands are documented for the external data.
- Capability inventory: The skill possesses the capability to make network requests and retrieve structured data for the agent to process.
- Sanitization: There is no evidence of sanitization, filtering, or validation of the retrieved YouTube content mentioned in the skill documentation.
Audit Metadata