youtube-competitor-analyzer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill shows API endpoints with a {API_KEY} placeholder and instructs obtaining an API key, which implies the agent would need to insert the secret verbatim into generated requests/commands (exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow calls the YouTube Data API at runtime to fetch competitor channel/video fields like snippet.description, snippet.title, and brandingSettings.keywords from outsider-authored public YouTube content, which can then be inserted into the agent’s LLM context for analysis/reporting (indirect prompt-injection risk).