youtube-retention-script-builder
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local utility script
..\_shared\scripts\youtube_growth_automation.pyto perform hook scoring, script planning, and report generation.- [EXTERNAL_DOWNLOADS]: Thecollect-videoscommand is used to fetch data from YouTube URLs, which is a well-known service.- [PROMPT_INJECTION]: The skill processes content from external YouTube videos, which represents an indirect prompt injection surface. - Ingestion points: Data is ingested via the
--videoparameter in thecollect-videoscommand (SKILL.md). - Boundary markers: The instructions do not provide explicit delimiters or "ignore instructions" warnings to help the agent distinguish between its core logic and external video content.
- Capability inventory: The agent can execute local Python scripts and perform file system writes (
.json,.html). - Sanitization: There is no evidence of content filtering or sanitization being applied to the external data before it is integrated into the agent's workflow.
Audit Metadata