youtube-title-tag-optimizer

Pass

Audited by Gen Agent Trust Hub on Sep 17, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill requires the installation of the google-api-python-client library. This is a well-known package from a trusted organization used for interacting with official YouTube APIs.
  • [COMMAND_EXECUTION]: The skill executes a bundled Python script scripts/optimize_title_tags.py via the shell to perform data collection and analysis. User-supplied keywords and working titles are passed as command-line arguments to this script.
  • [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes untrusted metadata from YouTube (video titles, tags, and descriptions) which is then used to generate a report for the user.
  • Ingestion points: Data is ingested via the YouTube Data API v3 (search.list and videos.list) within scripts/optimize_title_tags.py.
  • Boundary markers: The report structure in SKILL.md uses markdown headers and tables to separate data, but does not include explicit instructions to the agent to ignore potentially malicious content within the ingested titles or descriptions.
  • Capability inventory: The script has the capability to write JSON data files to the reports/data/ directory and creates markdown reports.
  • Sanitization: The skill uses a slugify function to sanitize filenames based on keywords, but the external metadata content is used directly in the text of the report analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 17, 2026, 04:37 AM