skool-post

Pass

Audited by Gen Agent Trust Hub on Jul 30, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The skill executes shell commands to utilize yt-dlp for extracting video transcripts and the gh CLI for retrieving GitHub repository metadata. These operations are restricted to specific, functional tasks defined in the skill logic.
  • [EXTERNAL_DOWNLOADS]: The skill fetches data from several external services, including YouTube, GitHub, and various web articles. These downloads are performed to gather source material for content generation and are directed at well-known services or user-specified URLs.
  • [PROMPT_INJECTION]: The skill ingests untrusted external data such as video transcripts and webpage content, which constitutes an indirect prompt injection surface. To address this, the skill contains explicit boundary instructions at the beginning of the file, directing the agent to treat all scraped content as data for analysis and to disregard any instructions found within that content.
Audit Metadata
Risk Level
SAFE
Analyzed
Jul 30, 2026, 03:50 PM