youtube-competitor-outlier-pulse
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes Python automation scripts using PowerShell, incorporating parameters such as channel IDs and file paths provided by the user.
- Evidence: Commands like
python ..\_shared\scripts\youtube_growth_automation.py channel-videos --channel-id UCxxxxdepend on user-supplied inputs. If these inputs are not properly validated, they could be used for command injection. - [PROMPT_INJECTION]: The skill processes untrusted content from the YouTube API and external data files, creating a surface for indirect prompt injection.
- Ingestion points: Metadata (titles, descriptions) from YouTube videos and user-uploaded CSV/JSON datasets processed in
SKILL.md. - Boundary markers: Absent; there are no instructions to use delimiters or ignore embedded instructions within the processed data.
- Capability inventory: The agent has the ability to execute shell commands, run Python scripts, and write files to the local system.
- Sanitization: No sanitization or escaping of external content is specified before processing or rendering into reports.
Audit Metadata