Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed YouTube content helper with an optional Tavily trend-search script that uses only the Tavily API key and does not show hidden persistence, local data access, or destructive behavior.
Install only if you are comfortable giving the skill access to a Tavily API key for optional trend searches. Avoid passing private topics or sensitive business plans to the trend analyzer unless you are comfortable sending that query to Tavily; otherwise use the offline title, hook, and script-generation parts.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
if not api_key:
return {"error": "TAVILY_API_KEY not set"}
response = requests.post(
'https://api.tavily.com/search',
json={
'api_key': api_key,
The declared skill purpose is content generation, but the detected behavior extends to external trend/search retrieval using Tavily and secret-backed network access. This mismatch is dangerous because users and reviewers may authorize the skill expecting offline text generation while it can make outbound requests, process external content, and use credentials in ways not transparently described.
The skill metadata declares an environment variable requirement and references script files, but does not declare an explicit tool scope or allowed tools. That creates an authorization gap where the runtime may permit network or secret-backed behavior that is not clearly disclosed to users or policy controls, increasing the chance of over-privileged execution.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Trend analyzer using Tavily API
SECURITY MANIFEST:
Environment variables accessed: TAVILY_API_KEY (only)
External endpoints called: https://api.tavily.com/ (only)
Local files read: none
Local files written: none
"""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Trend analyzer using Tavily API
SECURITY MANIFEST:
Environment variables accessed: TAVILY_API_KEY (only)
External endpoints called: https://api.tavily.com/ (only)
Local files read: none
Local files written: none
"""
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not api_key:
return {"error": "TAVILY_API_KEY not set"}
response = requests.post(
'https://api.tavily.com/search',
json={
'api_key': api_key,
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
if not api_key:
return {"error": "TAVILY_API_KEY not set"}
response = requests.post(
'https://api.tavily.com/search',
json={
'api_key': api_key,
No suspicious patterns detected.