youtube-competitor-analyzer

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly requires the user's YouTube Data API v3 key and shows example GET requests with key={API_KEY}, which implies the agent must accept and embed the secret verbatim into requests/commands (exfiltration risk).

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.80). This skill explicitly fetches and processes public, user-generated content from YouTube via the YouTube Data API v3 (see SKILL.md API endpoints like GET https://www.googleapis.com/youtube/v3/search and GET /videos and the "Competitor Discovery Methods" that extract keywords/titles/descriptions), and that third-party content is read and used to drive competitor ranking, content-gap analysis, and recommendations, so it could carry indirect prompt-injection risk.