youtube-apify-transcript
Pass
Audited by Gen Agent Trust Hub on Sep 19, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [SAFE]: The skill integrates with Apify's official API to retrieve transcripts, which is a legitimate use case for cloud-based research tools. It provides clear guidance for setting API tokens using environment variables.
- [EXTERNAL_DOWNLOADS]: The Python script makes network requests to api.apify.com and the vendor's proxy at api.gooseworks.ai to perform transcript scraping. These domains are consistent with the skill's stated purpose and author context.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from YouTube transcripts via an external API. While this creates a vulnerability surface, the skill lacks high-privilege capabilities (such as arbitrary command execution or access to sensitive credentials) that would make an injection attack exploitable.
- Ingestion points: The transcript data is retrieved in scripts/fetch_transcript.py.
- Boundary markers: None; transcripts are processed as plain text or JSON.
- Capability inventory: Restricted to local file writes for caching and standard terminal output.
- Sanitization: None.
Audit Metadata