youtube-comment-miner
Fail
Audited by Snyk on Sep 17, 2026
Risk Level: HIGH
Full Analysis
HIGH W007: Insecure credential handling detected in skill instructions.
- Insecure credential handling detected (high risk: 0.80). The skill instructs the agent to ask the user for an API key in plain text and then pass it directly inline via an environment variable prefix in shell commands (
YT_API_KEY=API_KEY python3 ...), which means the secret passes through the LLM's context and output.
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (medium risk: 0.30). The agent skill mines YouTube comments via the YouTube Data API v3, which ingests untrusted user-submitted video comments into the LLM workflow.
Issues (2)
W007
HIGHInsecure credential handling detected in skill instructions.
W011
MEDIUMThird-party content exposure detected (indirect prompt injection risk).
Audit Metadata