Youtube Factory

• Analyzed: May 12, 2026, 3:35 AM
• Findings: 1
• Version: 1.3.0
• Hash: 083f28f922fce2bb3402bafbabbcaf4886197153d543b794f21e4b3ca6d2b4be
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle appears benign. The `youtube_factory.py` script performs video generation using `ffmpeg` and `edge-tts`, downloads stock footage from Pexels, and creates temporary files. Crucially, it includes robust security measures such as sanitizing user-controlled inputs for file paths and captions, validating all download URLs against an allowlist of Pexels domains to prevent SSRF, and using `subprocess.run` with argument lists to mitigate shell injection risks. The `SKILL.md` documentation is clear and does not contain any prompt injection attempts or instructions for malicious behavior. While the Python script currently uses a hardcoded script instead of an LLM as described in `SKILL.md`, this is a functional limitation, not a security vulnerability or malicious act.