OverviewHistoryStatsSecurity
Security
Independent checks from skills.sh's audit partners.
Independent checks from skills.sh's audit partners.
Warn4 providerslatest audit Apr 16, 2026
Independent checks from skills.sh's audit partners.
This skill downloads YouTube transcripts and metadata. It uses the well-known yt-dlp tool as a fallback and employs flags that enable the execution of external components from GitHub. Additionally, it encourages the AI agent to autonomously install software if missing and processes untrusted transcript data with an LLM, creating a potential surface for indirect prompt injection.
Detected behaviors
No alerts
2 issues
Score: 93/100 · 2 sections analyzed