youtube-analytics

Pass

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party textual data (such as video titles, descriptions, comments, and tags) retrieved dynamically via the YouTube Data API during metadata processing and search workflows.
  • Ingestion points: SKILL.md (Channel Analysis, Video Performance, Search, and YouTube SEO Analysis steps fetching metadata via curl).
  • Boundary markers: Absent. The skill does not instruct the model to treat external content or API data boundaries as untrusted text strings.
  • Capability inventory: Employs standard curl commands in SKILL.md for querying standard HTTP services.
  • Sanitization: Absent. No specific filtering or escaping mechanisms are mandated for processing text returned from YouTube endpoints.
  • [COMMAND_EXECUTION]: Executable shell syntax is showcased using backtick-wrapped curl examples designed to invoke raw command line tools dynamically with explicit shell concatenation logic (key=${YOUTUBE_API_KEY}).
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 15, 2026, 10:51 AM