youmind-youtube-transcript

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill's workflow (SKILL.md Steps 3–5) calls createMaterialByUrl on arbitrary YouTube URLs and polls getMaterial to extract transcript.contents from those public YouTube videos via the YouMind service, so the agent directly ingests untrusted, user-generated transcript content and uses it to generate summaries and drive follow-up actions, enabling indirect prompt injection.