youtube-audience-bullseye-builder
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill invokes a local Python automation script (
..\_shared\scripts\youtube_growth_automation.py) to process JSON context files and generate HTML reports. This is a standard automation pattern for technical skills. - [INDIRECT_PROMPT_INJECTION]:
- Ingestion points: Processes channel context from
channel-context.jsonand user-provided free-form text (SKILL.md). - Boundary markers: The instructions do not define specific delimiters or security headers to separate untrusted user data from the agent's instructions.
- Capability inventory: The agent can read files, write JSON/HTML outputs, and execute shell commands via Python scripts (SKILL.md).
- Sanitization: No explicit validation or filtering logic is described for the incoming channel context data.
Audit Metadata