Most findings are scanner false positives caused by Markdown code fences, inline code, and relative documentation links. The skill explicitly runs local Python tooling, uses shell command substitution, and expects a YouTube API key. No prompt injection or data-exfiltration intent was found in the reviewed files.
2
Files scanned
507
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The workflow expects YOUTUBE_API_KEY and invokes a connector that can consume this secret-bearing environment value. The use appears legitimate, but the connector process receives credential access.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill explicitly instructs the agent to run a local Python YouTube connector. The executable and script path are fixed, but this remains external command execution with a creator handle argument.
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The inline shell example runs git to resolve a root and then executes rubric-score.py. This is explicit external command execution, not only Markdown formatting.
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The root-resolution expression contains $(git rev-parse ...), which executes git in a shell. It is a fixed command, but its result controls the later script path.
Most findings are scanner false positives caused by Markdown code fences, inline code, and relative documentation links. The skill explicitly runs local Python tooling, uses shell command substitution, and expects a YouTube API key. No prompt injection or data-exfiltration intent was found in the reviewed files.
2
Files scanned
507
Lines analyzed
8
Review items
0
False positives ignored
Capability review items (4)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The workflow expects YOUTUBE_API_KEY and invokes a connector that can consume this secret-bearing environment value. The use appears legitimate, but the connector process receives credential access.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill explicitly instructs the agent to run a local Python YouTube connector. The executable and script path are fixed, but this remains external command execution with a creator handle argument.
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The inline shell example runs git to resolve a root and then executes rubric-score.py. This is explicit external command execution, not only Markdown formatting.
5. **Run the deterministic scorer.** Follow [`runtime-invocation.md`](../../../references/runtime-in
The root-resolution expression contains $(git rev-parse ...), which executes git in a shell. It is a fixed command, but its result controls the later script path.
Most static findings are false positives caused by Markdown fences, inline code, and relative documentation links. One command-execution finding is confirmed because the skill directs an agent to run a Python connector with a user-provided handle without explicit argument validation. The skill also persists campaign and creator assessments to shared memory paths, creating a privacy and retention concern.
Persistent storage of campaign and creator assessments
The skill reads campaign and creator records, then requires saving detailed scores and promoting handles and verdicts to shared memory. This can retain sensitive campaign strategy and reputational assessments without explicit consent or retention controls.
The read, write, and promotion behavior is explicitly required in the skill contract and final instruction. No consent, scoping, deletion, or retention guidance appears in the reviewed files.
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill explicitly instructs the agent to execute a Python connector command. The creator handle is user-supplied, and the guidance does not specify validation or shell-safe argument handling.
Most static findings are false positives from Markdown links, inline file paths, or prompt examples. One connector command and one YouTube API key reference are confirmed because they require external command execution and secret-bearing environment access.
2
Files scanned
516
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
Line 58 references YOUTUBE_API_KEY for connector use, which is a secret-bearing environment variable. There is no exfiltration evidence, but the skill depends on sensitive environment access.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The skill instructs the agent to run python3 against a connector script using a user-supplied handle placeholder. The purpose is legitimate, but it is still external command execution that needs explicit permission and argument validation.
Static alerts were mostly caused by Markdown fences, inline paths, and repository documentation links. I confirmed one medium-risk issue: the skill shows a shell-style YouTube connector command using a candidate handle, which needs validation and non-shell execution guidance. No prompt injection, credential exfiltration, or unauthorized network endpoint was found in the scanned files.
2
Files scanned
516
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The line shows a shell-style python3 connector command that includes a candidate handle. If copied into a shell without validating the handle, it creates command-injection risk and requires user approval.
Static alerts were mostly caused by Markdown fences, inline paths, and repository documentation links. I confirmed one medium-risk issue: the skill shows a shell-style YouTube connector command using a candidate handle, which needs validation and non-shell execution guidance. No prompt injection, credential exfiltration, or unauthorized network endpoint was found in the scanned files.
2
Files scanned
516
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
The line shows a shell-style python3 connector command that includes a candidate handle. If copied into a shell without validating the handle, it creates command-injection risk and requires user approval.
Most static findings are false positives from Markdown code fences, static repository links, metadata URLs, and fixed memory paths. One confirmed issue remains: the skill tells agents to run a local YouTube connector with a user-supplied handle, so handle validation and execution confirmation are needed. No prompt injection, social engineering, or data-exfiltration intent was found in the reviewed files.
2
Files scanned
516
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
**Measured YouTube inputs (free key)**: for YouTube candidates, `python3 "${CLAUDE_PLUGIN_ROOT}/scri
Line 58 instructs the agent to run a local Python connector with a creator handle supplied by the user. Without explicit handle validation and confirmation, that external command path is a real execution surface.