youtube-analytics
Pass
Audited by Gen Agent Trust Hub on Jun 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTIONCREDENTIALS_UNSAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill executes local Python scripts 'analytics.py' and 'preflight.py' via 'python3'. It includes a bash command to change directory to an absolute path '/Users/gaebalai/Workspace2/youtube-bgm-auto' and activate a virtual environment.
- [PROMPT_INJECTION]: The skill presents an indirect prompt injection surface as it processes external channel and video metadata from the YouTube API. 1. Ingestion points: Video and channel data fetched via 'analytics.py'. 2. Boundary markers: Not specified. 3. Capability inventory: Subprocess execution and local file writing. 4. Sanitization: None mentioned for API content.
- [CREDENTIALS_UNSAFE]: The skill identifies and verifies sensitive files, specifically OAuth credentials and a 'PIXABAY_KEY', through its preflight validation script. Accessing or managing such sensitive credential files presents a risk of exposure.
Audit Metadata