youtube-comment-miner
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes a bundled Python script (scripts/mine_comments.py) to interact with the YouTube Data API and perform data analysis.
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the google-api-python-client package, which is the official and trusted library from Google.
- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from YouTube comments, creating a potential surface for indirect prompt injection attacks.
- Ingestion points: Comment text is fetched from the YouTube API in scripts/mine_comments.py.
- Boundary markers: No explicit delimiters or warnings are present in the instructions to prevent the agent from following instructions embedded in comments.
- Capability inventory: The skill can execute Python scripts and write results to the reports/ directory.
- Sanitization: The script performs keyword analysis but includes the original comment text in reports without sanitizing it for potential LLM instructions.
Audit Metadata