YouTube Transcript Extractor
Pass
Audited by Gen Agent Trust Hub on Oct 28, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill utilizes the
youtube-transcript-apipackage to fetch data from YouTube. This is a common and legitimate library for the skill's primary function.\n- [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted transcript data from YouTube, creating a potential surface for indirect prompt injection.\n - Ingestion points: Transcript content is fetched from the YouTube API in
scripts/get_youtube_transcript.py.\n - Boundary markers: No delimiters or isolation instructions are present to prevent the agent from executing instructions embedded within the transcript text.\n
- Capability inventory:
scripts/get_youtube_transcript.pyperforms network operations to YouTube and file-write operations to the current working directory.\n - Sanitization: No sanitization or filtering is performed on the transcript content before it is printed or saved.
Audit Metadata