tubeify
Pass
Audited by Gen Agent Trust Hub on Jul 18, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
curlto perform network operations, manage session cookies viasession.txt, and interact with server-side scripts. - [EXTERNAL_DOWNLOADS]: The skill communicates with
https://tubeify.xyz, a non-whitelisted third-party domain, to perform its primary functions. - [DATA_EXFILTRATION]: Sensitive identifiers such as a wallet address and raw video URLs are transmitted to an external endpoint (
https://tubeify.xyz/index.php) during the authentication and processing phases. - [PROMPT_INJECTION]: The skill is susceptible to indirect prompt injection due to the following factors: 1. Ingestion points: The agent reads and processes output from
https://tubeify.xyz/status.php. 2. Boundary markers: No delimiters or instructions are used to distinguish between API metadata and potentially malicious content in the response. 3. Capability inventory: The agent has access tocurlfor further network and file system interactions based on API instructions. 4. Sanitization: There is no evident filtering or validation of the data returned from the external service.
Audit Metadata