yt-shorts

Pass

Audited by Gen Agent Trust Hub on Sep 19, 2026

Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill instructs the agent to execute a local Python script located at ../yt-script/hookscore.py to score the quality of generated hooks. This involves invoking a shell command using a relative path to a script outside the skill's immediate directory.
  • [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process video transcripts, which are untrusted external data sources.
  • Ingestion points: Video transcripts provided as input to the agent (referenced in SKILL.md).
  • Boundary markers: Absent; there are no specific delimiters or instructions to prevent the agent from accidentally interpreting transcript content as instructions.
  • Capability inventory: Execution of local scripts via the command line (SKILL.md).
  • Sanitization: Absent; the instructions do not include steps to sanitize or validate the content of the transcripts before they are processed.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 19, 2026, 03:33 AM