youtube-automation

Pass

Audited by Gen Agent Trust Hub on Jun 21, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADS
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill directs users to connect to a vendor-managed MCP server at https://rube.app/mcp. This external service provides the necessary tool definitions and execution environment for the YouTube automation features.
  • [SAFE]: YouTube API access is managed through a secure OAuth 2.0 flow using the RUBE_MANAGE_CONNECTIONS tool, ensuring that no sensitive credentials or API keys are hardcoded or exposed within the skill instructions.
  • [SAFE]: The skill interacts with external content such as YouTube search results and user comments, which represents a potential surface for indirect prompt injection. This is a standard risk for social media integration tools and is handled within the operational scope of the agent's functionality.
  • Ingestion points: Search and comment tools (e.g., YOUTUBE_SEARCH_YOU_TUBE, YOUTUBE_LIST_COMMENT_THREADS) in SKILL.md.
  • Boundary markers: None explicitly defined within the prompt templates.
  • Capability inventory: High-privilege tools such as YOUTUBE_UPLOAD_VIDEO, YOUTUBE_UPDATE_VIDEO, and YOUTUBE_SUBSCRIBE_CHANNEL.
  • Sanitization: Documentation provides guidance on defensive parsing of nested response data and type-casting for statistical values.
Audit Metadata
Risk Level
SAFE
Analyzed
Jun 21, 2026, 09:30 AM
Security Audit — agent-trust-hub — youtube-automation