youtube-summarizer
Warn
Audited by Snyk on Feb 27, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). The skill explicitly fetches transcripts from public YouTube videos using youtube-transcript-api (see SKILL.md Step 2/3 and scripts/extract-transcript.py) and then reads that untrusted, user-generated transcript text into the AI summarization prompt (SKILL.md Step 4), meaning third-party content is ingested and can directly influence the agent's outputs and behavior.
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.80). The README/install steps explicitly instruct cloning and running code from https://github.com/ericgandrade/cli-ai-skills.git (and installing the external package referenced at https://github.com/jdepoix/youtube-transcript-api / via pip), which fetches remote code and runs installation scripts or packages required for the skill to operate.
Audit Metadata