youtube-automation
Pass
Audited by Gen Agent Trust Hub on Jun 21, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill directs users to connect to a vendor-managed MCP server at
https://rube.app/mcp. This external service provides the necessary tool definitions and execution environment for the YouTube automation features. - [SAFE]: YouTube API access is managed through a secure OAuth 2.0 flow using the
RUBE_MANAGE_CONNECTIONStool, ensuring that no sensitive credentials or API keys are hardcoded or exposed within the skill instructions. - [SAFE]: The skill interacts with external content such as YouTube search results and user comments, which represents a potential surface for indirect prompt injection. This is a standard risk for social media integration tools and is handled within the operational scope of the agent's functionality.
- Ingestion points: Search and comment tools (e.g.,
YOUTUBE_SEARCH_YOU_TUBE,YOUTUBE_LIST_COMMENT_THREADS) inSKILL.md. - Boundary markers: None explicitly defined within the prompt templates.
- Capability inventory: High-privilege tools such as
YOUTUBE_UPLOAD_VIDEO,YOUTUBE_UPDATE_VIDEO, andYOUTUBE_SUBSCRIBE_CHANNEL. - Sanitization: Documentation provides guidance on defensive parsing of nested response data and type-casting for statistical values.
Audit Metadata