gog-youtube
Pass
Audited by Gen Agent Trust Hub on Aug 17, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill consists of documentation and configuration for a YouTube integration. It does not contain any executable scripts, remote downloads, or credential exposures.
- [INDIRECT_PROMPT_INJECTION]: The skill is designed to ingest and process data from YouTube, such as comments and video descriptions, which represents an attack surface for indirect prompt injection. However, the instructions explicitly recommend the use of the
--wrap-untrustedflag when processing this content to mitigate the risk of the agent following embedded instructions. - Ingestion points: YouTube API outputs (comments, activities, search results).
- Boundary markers: The instructions recommend using the
--wrap-untrustedflag to delimit untrusted content. - Capability inventory: The skill uses the 'gog' CLI tool for read and write operations on YouTube.
- Sanitization: The use of
--wrap-untrustedis suggested as a standard sanitization/boundary practice.
Audit Metadata