youtube-title-tag-optimizer
Pass
Audited by Gen Agent Trust Hub on Sep 17, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill requires the installation of the
google-api-python-clientlibrary. This is a well-known package from a trusted organization used for interacting with official YouTube APIs. - [COMMAND_EXECUTION]: The skill executes a bundled Python script
scripts/optimize_title_tags.pyvia the shell to perform data collection and analysis. User-supplied keywords and working titles are passed as command-line arguments to this script. - [INDIRECT_PROMPT_INJECTION]: The skill fetches and processes untrusted metadata from YouTube (video titles, tags, and descriptions) which is then used to generate a report for the user.
- Ingestion points: Data is ingested via the YouTube Data API v3 (
search.listandvideos.list) withinscripts/optimize_title_tags.py. - Boundary markers: The report structure in
SKILL.mduses markdown headers and tables to separate data, but does not include explicit instructions to the agent to ignore potentially malicious content within the ingested titles or descriptions. - Capability inventory: The script has the capability to write JSON data files to the
reports/data/directory and creates markdown reports. - Sanitization: The skill uses a
slugifyfunction to sanitize filenames based on keywords, but the external metadata content is used directly in the text of the report analysis.
Audit Metadata