skills/nikhilbhansali/youtube-data-skills/youtube-title-tag-optimizer/Snyk

youtube-title-tag-optimizer

Fail

Audited by Snyk on Sep 17, 2026

Risk Level: HIGH

Full Analysis

HIGH W007: Insecure credential handling detected in skill instructions.

Insecure credential handling detected (high risk: 1.00). The skill instructs the agent to ask the user for an API key and then embed it directly into a bash command invocation (YT_API_KEY=API_KEY), passing the secret through the execution context.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

Third-party content exposure detected (medium risk: 0.30). The skill searches YouTube videos by keyword using the YouTube Data API and ingests video titles, descriptions, and tags authored by arbitrary public YouTube creators.

Issues (2)

W007

HIGH

Insecure credential handling detected in skill instructions.

W011

MEDIUM

Third-party content exposure detected (indirect prompt injection risk).

Audit Metadata

Risk Level

HIGH

Analyzed

Sep 17, 2026, 04:37 AM

Issues

2