video-transcript-downloader

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's runtime (scripts/vtd.js) explicitly fetches transcripts/subtitles from public, user-generated video sources—using YoutubeTranscript.fetchTranscript for YouTube IDs and yt-dlp to download subtitles from arbitrary URLs—so untrusted third‑party content is ingested and parsed as part of the transcript workflow (SKILL.md + scripts/vtd.js).