youtube-channel-lead-scraper

CRITICAL E004: Prompt injection detected in skill instructions.

• Potential prompt injection detected (high risk: 0.80). The skill includes explicit instructions to install dependencies automatically and to hide or avoid seeking user approval for that installation, which is deceptive and outside the scraping task's stated purpose.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). This skill explicitly automates harvesting of contact details (emails) from YouTube channels and contains instructions to install a runtime dependency automatically and without user confirmation, creating privacy/data-exfiltration and supply-chain/unauthorized-installation risks.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). SKILL.md instructs the agent to invoke the BrowserAct CLI to access and interact with public YouTube pages at runtime, which can cause outsider-authored free text (e.g., channel/About page content) to be ingested into the LLM context via the browser-extracted page text.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill requires installing and invoking the BrowserAct CLI at runtime and explicitly directs the agent to automatically use the installer URL https://www.browseract.com/?co-from=lead-generation (and the redirect variant) to obtain the required Skill, which implies fetching and executing external code during runtime.

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The Skill explicitly directs the agent to install the BrowserAct dependency automatically "without asking the user to confirm" and not request separate approval, which encourages modifying the host system state (installing software) without user consent and could invoke privileged operations.