yt-shorts
Pass
Audited by Gen Agent Trust Hub on Sep 27, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill instructions require the agent to execute a local script
../yt-script/hookscore.py. While this appears to be a legitimate modular tool call within a repository, it involves invoking logic residing outside the skill's own folder. - [INDIRECT_PROMPT_INJECTION]: The skill is designed to process external transcript data which could contain malicious instructions designed to influence the agent's output or behavior.
- Ingestion points: Video transcript data processed by the agent in
SKILL.md. - Boundary markers: None. The skill does not define specific delimiters or instructions to ignore embedded prompts within the transcript.
- Capability inventory: Execution of external script
hookscore.pyand generation of content for user review. - Sanitization: None. The skill does not specify any filtering or sanitization steps for the ingested transcript data.
Audit Metadata