youtube-own-channel-analyzer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The prompt explicitly shows API endpoints with ?key={API_KEY} and instructs obtaining an API key, which encourages the agent to embed the secret verbatim into requests/commands (an insecure exfiltration pattern).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow fetches YouTube channel/video metadata (including titles and descriptions) from the YouTube Data API at runtime, and those fields are outsider-authored free text from other creators, which the agent would ingest into the LLM context for analysis.