youtube-competitor-analyzer
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill makes network requests to the official Google APIs (
googleapis.com) to retrieve YouTube channel and video data. This interaction is essential for the skill's primary purpose and targets a well-known technology service. - [CREDENTIALS_UNSAFE]: To function, the skill requires a user-supplied YouTube Data API v3 key. The provided API reference documentation demonstrates using this key as a query parameter in URL requests. While standard for this API, this practice is a minor security concern as it can lead to credentials appearing in server or proxy logs.
- [PROMPT_INJECTION]: The skill ingests untrusted data from external sources (YouTube metadata), which constitutes a surface for indirect prompt injection.
- Ingestion points: External channel descriptions, titles, and branding keywords are retrieved via the
channelsandsearchendpoints (documented in SKILL.md and references/api_reference.md). - Boundary markers: None identified. The skill does not use specific delimiters to isolate external metadata from its core instructions.
- Capability inventory: The skill's actions are restricted to reading API data and outputting Markdown reports. It lacks capabilities for filesystem modification, system command execution, or non-Google network operations.
- Sanitization: No explicit sanitization or filtering logic is present for the data retrieved from YouTube before it is used in report generation.
Audit Metadata