yt-script
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructions direct the agent to execute a local Python script,
hookscore.py, to perform text analysis and scoring on YouTube hooks. This script is part of the skill package and uses standard library modules. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process untrusted user data, including raw video ideas and transcribed content from external videos, to generate scripts.
- Ingestion points: The skill ingests raw video ideas from the user, transcriptions of provided videos, and a local voice profile file located at
~/.codex/youtube/voice.md. - Boundary markers: The instructions do not define specific boundary markers or "ignore" instructions when processing the external data.
- Capability inventory: The skill executes a local Python analysis script and reads/writes local voice profile files.
- Sanitization: Input data is processed via regular expressions for scoring but is not sanitized to prevent instruction injection within the generated script.
Audit Metadata