youtube-feed
Warn
Audited by Snyk on Feb 15, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).
- Third-party content exposure detected (high risk: 0.90). This skill's scripts (scripts/get_updates.py) fetch and parse public YouTube RSS feeds (https://www.youtube.com/feeds/videos.xml?channel_id=...) and scrape public YouTube pages (https://www.youtube.com/watch?v=...) and mirrored pages (r.jina.ai), then read and summarize untrusted user-generated titles/descriptions as part of its workflow, which could allow indirect prompt injection.
Audit Metadata