youtube-clipper
Warn
Audited by Snyk on Feb 17, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly downloads and parses public YouTube content (videos and VTT subtitles via scripts/download_video.py) and then sends the full subtitle_text to Claude for semantic chapter analysis and translation (see scripts/analyze_subtitles.py, scripts/translate_subtitles.py, scripts/generate_summary.py), so the agent will ingest untrusted, user-generated content from public YouTube pages and could be exposed to indirect prompt injection.
Audit Metadata