youtube-thumbnail-analyzer
Pass
Audited by Gen Agent Trust Hub on Sep 16, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill requires the agent to execute a bundled Python script (
scripts/fetch_thumbnails.py) usingpython3. This script interacts with the YouTube Data API to retrieve video information and download images.- [INDIRECT_PROMPT_INJECTION]: The skill exhibits an indirect prompt injection surface through the ingestion of untrusted data from external sources. - Ingestion points: The agent reads downloaded thumbnail images from
reports/thumbnails/and processes video metadata (titles, descriptions) from generated JSON files inreports/data/(Step 5 and Step 6). - Boundary markers: There are no explicit boundary markers or instructions to the agent to disregard potential malicious directives embedded within the visual content or metadata of the thumbnails.
- Capability inventory: The skill has the capability to execute shell commands (Python script), read local files (images and JSON), and write report files to the filesystem.
- Sanitization: No sanitization or validation is performed on the text found within thumbnails or video metadata before it is processed for visual analysis.
Audit Metadata