youtube-competitor-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted metadata (channel titles, descriptions, and video tags) from external YouTube channels to generate competitive analysis reports, which could be used to host malicious instructions.
- Ingestion points: The script
scripts/analyze_competitors.pyfetches channel and video metadata via the YouTube Data API. - Boundary markers: There are no explicit boundary markers or instructions to ignore embedded prompts within the retrieved data stored in
reports/data/*.json. - Capability inventory: The skill allows the agent to write files to the local filesystem and provides the agent with processed data to synthesize into a final markdown report.
- Sanitization: No sanitization or filtering is performed on the retrieved string fields before they are written to the data files and subsequently read by the agent.
Audit Metadata