youtube-skill
Pass
Audited by Gen Agent Trust Hub on Oct 7, 2026
Risk Level: SAFE
Full Analysis
- [DYNAMIC_EXECUTION]: The youtube_skill.py script utilizes os.execv to automatically switch the execution context to a local virtual environment. This is a functional requirement to ensure the correct dependencies are loaded in environments with restricted global package installation.
- [DYNAMIC_EXECUTION]: The cmd_export_crate function uses import("time") to dynamically load the standard time module. This is used for timestamping exported JSON data and does not facilitate untrusted code execution.
- [INDIRECT_PROMPT_INJECTION]: The skill retrieves and parses external data from YouTube, such as video titles and comments, creating an ingestion surface for potentially malicious instructions. The risk is mitigated by the structured JSON output format and the heuristic parsing of metadata.
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the official YouTube oEmbed API to resolve video information when importing Takeout CSVs. These requests are directed to a well-known service for legitimate metadata retrieval.
Audit Metadata