youtube
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill communicates exclusively with official YouTube Data API endpoints at
www.googleapis.com. This is a well-known service, and the network operations are strictly aligned with the skill's stated purpose. - [SAFE]: Authentication is handled using standard OAuth 2.0 connection selectors or environment variables. The skill does not contain hardcoded credentials and explicitly advises users to manage secrets out-of-band.
- [SAFE]: The skill uses
child_process.spawnSyncin its CLI entry point to execute its own internal scripts using the host's Node.js binary. This is a standard architectural pattern for this vendor's connectors and does not involve executing untrusted remote code. - [SAFE]: The skill processes untrusted data from YouTube (such as video comments and descriptions) and has high-privilege capabilities (like deleting videos). However, it implements robust mitigation via structured Zod schemas for all data ingestion and provides specific disambiguation and refusal instructions to the agent to prevent unintended behavior.
Audit Metadata