youtube-analytics
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted third-party textual data (such as video titles, descriptions, comments, and tags) retrieved dynamically via the YouTube Data API during metadata processing and search workflows.
- Ingestion points:
SKILL.md(Channel Analysis, Video Performance, Search, and YouTube SEO Analysis steps fetching metadata viacurl). - Boundary markers: Absent. The skill does not instruct the model to treat external content or API data boundaries as untrusted text strings.
- Capability inventory: Employs standard
curlcommands inSKILL.mdfor querying standard HTTP services. - Sanitization: Absent. No specific filtering or escaping mechanisms are mandated for processing text returned from YouTube endpoints.
- [COMMAND_EXECUTION]: Executable shell syntax is showcased using backtick-wrapped
curlexamples designed to invoke raw command line tools dynamically with explicit shell concatenation logic (key=${YOUTUBE_API_KEY}).
Audit Metadata