mrbeast-perspective
Pass
Audited by Gen Agent Trust Hub on Apr 9, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The script
scripts/fetch_youtube_subtitles.shdownloads subtitle content from YouTube using the well-known utilityyt-dlp. It also manages the tool's presence by attempting to install it viapipif it is not found in the environment. - [COMMAND_EXECUTION]: The skill includes several Python and Shell scripts (
analyze_titles.py,retention_curve_checker.py,thumbnail_audit.py, andfetch_youtube_subtitles.sh) designed to perform file system operations and metadata analysis. - [REMOTE_CODE_EXECUTION]: The skill facilitates the runtime installation of the
yt-dlpPython package, a common practice for ensuring the availability of this well-known service tool. - [COMMAND_EXECUTION]: The skill presents an indirect prompt injection surface because it processes untrusted data from YouTube subtitles and local script files. 1. Ingestion points:
scripts/fetch_youtube_subtitles.sh(external subtitle content) andscripts/retention_curve_checker.py(user-provided scripts). 2. Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish untrusted ingested content from its core instructions. 3. Capability inventory: The skill utilizes subprocess execution, file system access, and network operations through its scripts. 4. Sanitization: No sanitization or filtering is performed on the ingested text before it is presented to the agent for analysis.
Audit Metadata