util-youtube-analyzer
Warn
Audited by Snyk on Feb 16, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill fetches and processes transcripts from arbitrary public YouTube URLs using scripts/yt-transcript.sh (yt-dlp downloads captions/audio) and then the agent reads the saved transcript (/tmp/yt-transcript-{video_id}.txt), exposing it to untrusted, user-generated third-party content.
Audit Metadata