YouTube To Blog

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:29 PM UTC
• Version:
  1.0.0

Overview

This is a plain instruction-only writing skill that fetches or uses a provided YouTube transcript to draft a blog post, with no hidden code or persistence found.

Install only if you are comfortable with your agent accessing YouTube caption data for URLs you provide. Invoke the skill explicitly, treat fetched transcripts as untrusted source material, and review generated posts for accuracy, copyright/usage rights, and accidental transcript artifacts before publishing.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The README exposes a very broad natural-language invocation pattern ('Use youtube-to-blog with this video/transcript') without clear trigger boundaries, parameter validation expectations, or exclusions. In agent environments, overly generic invocation phrasing can cause accidental or adversarial activation on untrusted content, making prompt-routing and downstream handling of arbitrary URLs or pasted transcript text less predictable.

VirusTotal

63/63 vendors flagged this skill as clean.