skool-post
Pass
Audited by Gen Agent Trust Hub on Jul 30, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill executes shell commands to utilize
yt-dlpfor extracting video transcripts and theghCLI for retrieving GitHub repository metadata. These operations are restricted to specific, functional tasks defined in the skill logic. - [EXTERNAL_DOWNLOADS]: The skill fetches data from several external services, including YouTube, GitHub, and various web articles. These downloads are performed to gather source material for content generation and are directed at well-known services or user-specified URLs.
- [PROMPT_INJECTION]: The skill ingests untrusted external data such as video transcripts and webpage content, which constitutes an indirect prompt injection surface. To address this, the skill contains explicit boundary instructions at the beginning of the file, directing the agent to treat all scraped content as data for analysis and to disregard any instructions found within that content.
Audit Metadata