youtube-content
Pass
Audited by Gen Agent Trust Hub on Jun 29, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill's setup instructions recommend installing the 'youtube-transcript-api' package from the standard Python Package Index (PyPI), which is a well-known and reputable library for this purpose.
- [PROMPT_INJECTION]: The skill ingests and processes transcripts from external YouTube videos, which represents a surface for indirect prompt injection if a video transcript contains malicious instructions.
- Ingestion points: External data enters the agent context via the transcript fetched by the
scripts/fetch_transcript.pyscript. - Boundary markers: The skill does not currently define specific delimiters or boundary instructions to isolate the transcript content from the agent's core instructions.
- Capability inventory: The provided scripts are limited to data retrieval and transformation; there are no capabilities for sensitive file access, network exfiltration, or unauthorized command execution.
- Sanitization: The transcript text is passed to the agent for formatting without prior filtering or sanitization of potential injection patterns.
Audit Metadata