youtube-thumbnails

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill asks the agent to retrieve or prompt the user for a YouTube Data API key and then instructs embedding it verbatim in a command-line argument (--api-key API_KEY), which requires the LLM to handle and output the secret directly.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 1.00). The skill's required script explicitly calls the YouTube Data API (channels(), playlistItems(), videos()) and makes direct HTTP HEAD/GET requests to youtube.com and img.youtube.com (see verify_is_livestream, verify_is_short and thumbnail download functions in the SKILL.md script), thereby ingesting untrusted, user-generated YouTube page HTML, titles, and thumbnails that are read and used to classify items and decide what to download, so third-party content can materially influence agent behavior.