youtube-research
Pass
Audited by Gen Agent Trust Hub on May 13, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION]: The skill uses the
yt-dlputility (viapython3 -m yt_dlp) to download video content. This execution is confined to a specific, well-known tool and is triggered by video URLs discovered or provided during the research workflow. - [CREDENTIALS_UNSAFE]: The skill manages session tokens and configuration in standard local directories (e.g.,
~/.config/postplus/config.json). This is a standard practice for CLI-integrated tools to maintain authenticated sessions with their own cloud backend and does not constitute credential theft. - [EXTERNAL_DOWNLOADS]: The skill performs legitimate data collection from social media platforms via PostPlus Cloud APIs. It also downloads video files using
yt-dlp. These operations are transparently documented and essential to the skill's primary function of audience and channel research. - [DATA_EXFILTRATION]: No unauthorized data exfiltration was detected. Network communication is limited to PostPlus infrastructure for capability execution and public social media domains for content discovery.
- [REMOTE_CODE_EXECUTION]: No patterns of remote code execution or untrusted script evaluation were found. The skill relies on local scripts and well-defined API contracts with the vendor's cloud environment.
Audit Metadata