yt-package

Pass

Audited by Gen Agent Trust Hub on Sep 27, 2026

Risk Level: SAFE
Full Analysis
  • [DATA_EXPOSURE]: The skill attempts to read a user voice profile from ~/.codex/youtube/voice.md. This is a targeted access to a local configuration file intended to provide context for the creative task.
  • [COMMAND_EXECUTION]: The skill executes title.py, a script included within the skill package, to perform string analysis on titles and thumbnails. The execution is localized and restricted to the provided logic.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to process video transcripts to infer a 'voice profile'. While this represents a surface for ingesting external content, the skill's capabilities are limited to scoring metadata strings against static rules, posing no significant risk to the agent environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 27, 2026, 07:12 PM