youtube-title-strategist
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to run a Python script (
youtube_growth_automation.py) located in a relative path (..\_shared\scripts\) outside the skill's folder. This involves executing a vendor-managed external resource whose specific logic is not verified within the skill's distribution.\n- [COMMAND_EXECUTION]: The automation workflow invokes shell commands to execute Python scripts, passing local JSON files as arguments to perform scoring and rendering tasks.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes multiple JSON data files (e.g.,titles.json,trend-search.json) that could potentially contain untrusted instructions if the data sources are compromised.\n - Ingestion points: SKILL.md documentation details reading from
titles.json,bullseye-starter.json,title-scores.json,hook-scores.json,retention-plan.json,trend-search.json, andcompetitor-pulse.json.\n - Boundary markers: None identified; parameters are passed as direct file paths to the automation script.\n
- Capability inventory: The skill possesses the capability to execute Python scripts via the shell and write HTML and JSON artifacts to the filesystem.\n
- Sanitization: There is no evidence of data validation or sanitization before the JSON content is processed by the external scoring and rendering scripts.
Audit Metadata