video-transcript-downloader

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The skill’s transcript runtime path fetches outsider-authored free text from YouTube (via youtube-transcript-plus → YoutubeTranscript.fetchTranscript(id)), or from third-party subtitle files downloaded by yt-dlp (ytDlpSubtitlesToTemp → reads .vtt/.srt and parses into segments), which then get emitted as LLM-readable paragraph text.