youtube-thumbnails
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill downloads thumbnail images from YouTube's official image hosting domain (img.youtube.com). These requests target a well-known service and are directly related to the skill's primary functionality.
- [COMMAND_EXECUTION]: The skill executes a local Python script to handle API data retrieval, classification logic, and report generation.
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from the YouTube API, creating a surface where instructions could be embedded in video metadata. 1. Ingestion points: Video titles and channel descriptions are fetched via the YouTube Data API in scripts/download_thumbnails.py. 2. Boundary markers: The generated markdown index does not employ specific delimiters to isolate external text from agent instructions. 3. Capability inventory: The skill can write files to the local reports directory and perform HTTP GET/HEAD requests to YouTube domains. 4. Sanitization: Filenames are sanitized for safety, but video metadata is interpolated into the markdown report without specific escaping to prevent injection.
Audit Metadata