youtube-digest

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's extraction pipeline clearly fetches and ingests public, user-generated content (YouTube transcripts and third‑party transcript pages) — e.g., scripts/fetch_transcript.py pulls YouTube page HTML and captionTracks via urllib/InnerTube and SKILL.md Tier 2 describes using WebFetch/WebSearch to retrieve transcript pages — and the agent directly reads and analyzes that content to drive digests and triage decisions.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.70). The skill, during runtime, fetches transcripts and metadata via YouTube’s InnerTube API endpoint (POST to https://www.youtube.com/youtubei/v1/player?key={api_key}) and then retrieves caption XML from the caption track “baseUrl”, and those externally-fetched texts are required inputs injected into the LLM context to drive the agent’s outputs.