youtube-clip-extractor
Pass
Audited by Gen Agent Trust Hub on Mar 10, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: Outlines the use of
yt-dlpandffmpegvia the command line for media acquisition and editing. These are expected and legitimate tools for the skill's workflow. - [EXTERNAL_DOWNLOADS]: Recommends the installation of well-known, open-source utilities through the Homebrew package manager, which is a trusted source.
- [PROMPT_INJECTION]: The skill contains a surface for indirect prompt injection by analyzing external YouTube transcripts.
- Ingestion points: The agent reads and analyzes data from external subtitle files (
.vtt) in Phase 2. - Boundary markers: The instructions lack markers to delineate the transcript or directives to ignore instructions embedded within the processed text.
- Capability inventory: The skill assumes the ability to write files and execute shell commands for media processing.
- Sanitization: No sanitization or safety checks are performed on the transcript data before analysis.
Audit Metadata