mrbeast-perspective

Pass

Audited by Gen Agent Trust Hub on Apr 9, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The script scripts/fetch_youtube_subtitles.sh downloads subtitle content from YouTube using the well-known utility yt-dlp. It also manages the tool's presence by attempting to install it via pip if it is not found in the environment.
  • [COMMAND_EXECUTION]: The skill includes several Python and Shell scripts (analyze_titles.py, retention_curve_checker.py, thumbnail_audit.py, and fetch_youtube_subtitles.sh) designed to perform file system operations and metadata analysis.
  • [REMOTE_CODE_EXECUTION]: The skill facilitates the runtime installation of the yt-dlp Python package, a common practice for ensuring the availability of this well-known service tool.
  • [COMMAND_EXECUTION]: The skill presents an indirect prompt injection surface because it processes untrusted data from YouTube subtitles and local script files. 1. Ingestion points: scripts/fetch_youtube_subtitles.sh (external subtitle content) and scripts/retention_curve_checker.py (user-provided scripts). 2. Boundary markers: No specific delimiters or instructions are provided to the agent to distinguish untrusted ingested content from its core instructions. 3. Capability inventory: The skill utilizes subprocess execution, file system access, and network operations through its scripts. 4. Sanitization: No sanitization or filtering is performed on the ingested text before it is presented to the agent for analysis.
Audit Metadata
Risk Level
SAFE
Analyzed
Apr 9, 2026, 07:12 AM