youtube-channel-insights

Pass

Audited by Gen Agent Trust Hub on Sep 2, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources (YouTube API responses) which may include content like video titles, descriptions, and search queries that could contain malicious instructions designed to influence the agent's behavior during report generation.
  • Ingestion points: The fetch_insights.py script retrieves video metadata and traffic source details from the YouTube Data and Analytics APIs.
  • Boundary markers: There are no explicit delimiters or specific instructions for the agent to ignore potentially malicious content embedded within the retrieved API data.
  • Capability inventory: The skill has the capability to write files to the local directory (reports/data/) and generates reports that are interpreted by the agent.
  • Sanitization: The script does not appear to sanitize or filter strings retrieved from the API before they are processed by the agent.
  • [COMMAND_EXECUTION]: The skill's operational flow involves the execution of local Python scripts (scripts/auth.py and scripts/fetch_insights.py) to handle authentication and data retrieval. This is the intended behavior for the skill's analytical functions.
  • [EXTERNAL_DOWNLOADS]: The setup instructions direct the user to install well-known libraries (google-api-python-client and google-auth-oauthlib) from the official Python Package Index (PyPI). These libraries are provided by a well-known technology company and are standard for Google API integrations.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 2, 2026, 10:26 PM
Security Audit — agent-trust-hub — youtube-channel-insights