youtube-trend-jacking-finder
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFECOMMAND_EXECUTIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a local Python script (
youtube_growth_automation.py) located in a shared directory (..\_shared\scripts\) to automate YouTube search queries and generate HTML reports. This is a standard functional component for data retrieval and analysis. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection as it processes data from external YouTube search results without sanitization.
- Ingestion points: External data from YouTube search queries is saved to
trend-search.json(referenced inSKILL.md) and subsequently processed by the agent. - Boundary markers: There are no delimiters or instructions to the agent to ignore potential instructions embedded within the fetched video titles or descriptions.
- Capability inventory: The skill has the capability to execute shell commands via the
youtube_growth_automation.pyscript as defined inSKILL.md. - Sanitization: There is no evidence of sanitization or filtering of the external data before it is used to score opportunities or generate video ideas.
Audit Metadata