OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Fail5 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
The skill fetches YouTube transcripts which are attacker-controlled external content. Because the agent is instructed to process (clean up) and save this content to the filesystem, it is vulnerable to Indirect Prompt Injection if a video transcript contains malicious instructions.
Detected behaviors
No alerts
No issues
2 files scanned · No issues
Score: 93/100 · 2 sections analyzed