yt-package
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFE
Full Analysis
- [DATA_EXPOSURE]: The skill attempts to read a user voice profile from
~/.codex/youtube/voice.md. This is a targeted access to a local configuration file intended to provide context for the creative task. - [COMMAND_EXECUTION]: The skill executes
title.py, a script included within the skill package, to perform string analysis on titles and thumbnails. The execution is localized and restricted to the provided logic. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process video transcripts to infer a 'voice profile'. While this represents a surface for ingesting external content, the skill's capabilities are limited to scoring metadata strings against static rules, posing no significant risk to the agent environment.
Audit Metadata