yt-thumbnail-brief
Pass
Audited by Gen Agent Trust Hub on Sep 15, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests untrusted data from users and external URLs to generate design briefs and platform metadata. Ingestion points include user-provided video titles, emotional tones, and data from URLs processed via the internal lib/url_parser.py script. There are no explicit boundary markers or instructions documented to separate user-provided data from agent instructions. The skill possesses the capability to modify video post metadata using the lib.PubloraClient.set_thumbnail helper. No explicit sanitization or validation of the input data is mentioned before it is processed or used in API calls.
- [COMMAND_EXECUTION]: The skill instructions involve the execution of internal library functions and scripts, including lib/url_parser.py for input processing and lib.PubloraClient.set_thumbnail for platform interaction.
Audit Metadata