Most static alerts are false positives caused by Markdown code fences, inline code, and relative documentation links. Two findings remain because line 59 executes an unreviewed connector and requires an API key. The workflow also needs safeguards for untrusted public web content and stored creator contact data.
Untrusted Web Content Has No Prompt-Injection Boundary
The workflow tells the agent to search and read public profiles, posts, and websites without directing it to treat embedded instructions as untrusted data. A malicious creator page could influence the agent's research or output.
The cited instructions explicitly require consuming open-web content, and no content-isolation guidance appears in the reviewed files. Exploitation depends on encountering a malicious page.
The workflow collects public business contact paths and stores roster-worthy creator records in durable memory. It does not define data minimization, retention, deletion, or access controls for this contact data.
The files clearly specify contact discovery and durable record storage. The data is limited to public business channels, which reduces severity but does not remove privacy obligations.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Line 59 directs execution of a Python connector outside the scanned skill and substitutes a creator handle into a shell-style command. An untrusted handle or connector could cause command execution beyond the documented lookup.
Line 59 requires YOUTUBE_API_KEY for a connector whose implementation was not included in the scanned files. The use is plausible, but secret handling and destination controls cannot be verified, so this remains fail-closed.
Most static alerts are false positives caused by Markdown code fences, inline code, and relative documentation links. Two findings remain because line 59 executes an unreviewed connector and requires an API key. The workflow also needs safeguards for untrusted public web content and stored creator contact data.
Untrusted Web Content Has No Prompt-Injection Boundary
The workflow tells the agent to search and read public profiles, posts, and websites without directing it to treat embedded instructions as untrusted data. A malicious creator page could influence the agent's research or output.
The cited instructions explicitly require consuming open-web content, and no content-isolation guidance appears in the reviewed files. Exploitation depends on encountering a malicious page.
The workflow collects public business contact paths and stores roster-worthy creator records in durable memory. It does not define data minimization, retention, deletion, or access controls for this contact data.
The files clearly specify contact discovery and durable record storage. The data is limited to public business channels, which reduces severity but does not remove privacy obligations.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Line 59 directs execution of a Python connector outside the scanned skill and substitutes a creator handle into a shell-style command. An untrusted handle or connector could cause command execution beyond the documented lookup.
Line 59 requires YOUTUBE_API_KEY for a connector whose implementation was not included in the scanned files. The use is plausible, but secret handling and destination controls cannot be verified, so this remains fail-closed.
Most static alerts are Markdown formatting or relative documentation links with no executable traversal. Two real risks remain: unsafe filename interpolation and an external connector command. The workflow also stores aggregated creator profile and contact data without retention guidance.
Persistent Creator Profile and Contact Aggregation
The workflow collects creator identity, audience, brand-safety, partnership, and public contact details, then stores selected records in persistent memory without retention guidance.
The cited sections explicitly define profile, contact, and persistence fields. The data is public, but the aggregation and retention risk is clear.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Save the report to `memory/influencer/influencer-discovery/YYYY-MM-DD-<topic>.md` and promote top-ti
The report path includes a user-derived topic placeholder without sanitization. A topic containing separators or traversal tokens could redirect the write outside the intended directory.
The line explicitly directs the agent to execute a Python connector outside the reviewed files. The handle placeholder lacks a required validation or argument-safety rule.
Most static findings are false positives from Markdown links, inline code, and placeholder paths, not executable traversal or shell usage. One optional YouTube metrics instruction includes a real local command using an environment-derived path, so it should remain gated by user consent. No prompt injection or credential-exfiltration intent was found.
4
Files scanned
600
Lines analyzed
5
Review items
0
False positives ignored
Capability review items (1)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Line 59 directs the agent to run a local Python connector from CLAUDE_PLUGIN_ROOT with a user-supplied handle. It appears legitimate, but it is still external command execution and should require confirmation and argv-safe invocation.
Most static findings are false positives caused by Markdown code fences, inline backticks, relative documentation links, and public URLs. The skill does include an optional YouTube connector command that can execute local code and consume a YouTube API key, so that path needs explicit opt-in. I found no prompt injection text or malicious data-exfiltration intent in the reviewed files.
4
Files scanned
600
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Line 59 points to a connector script under CLAUDE_PLUGIN_ROOT and a parent-directory README path. This can move execution and documentation trust outside the skill package.
Line 59 names YOUTUBE_API_KEY and implies the connector will consume that secret for API calls. The use appears bounded, but environment-secret access needs opt-in handling.
Line 59 instructs use of a local python3 connector command with a handle argument. This is legitimate for YouTube metrics, but it can execute local code and should require explicit user approval.
Most static findings are false positives caused by Markdown code fences, inline backticks, relative documentation links, and public URLs. The skill does include an optional YouTube connector command that can execute local code and consume a YouTube API key, so that path needs explicit opt-in. I found no prompt injection text or malicious data-exfiltration intent in the reviewed files.
4
Files scanned
600
Lines analyzed
7
Review items
0
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Line 59 points to a connector script under CLAUDE_PLUGIN_ROOT and a parent-directory README path. This can move execution and documentation trust outside the skill package.
Line 59 names YOUTUBE_API_KEY and implies the connector will consume that secret for API calls. The use appears bounded, but environment-secret access needs opt-in handling.
Line 59 instructs use of a local python3 connector command with a handle argument. This is legitimate for YouTube metrics, but it can execute local code and should require explicit user approval.
The audit found no prompt injection, credential theft, arbitrary filesystem traversal, or malicious intent in the reviewed Markdown files. Most static findings are false positives caused by Markdown links, inline code formatting, and example templates. The retained risks are an optional Python connector command and optional outbound oEmbed lookups, both legitimate but requiring disclosure and user consent.
4
Files scanned
600
Lines analyzed
6
Review items
0
False positives ignored
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
The line explicitly instructs running `python3` against a connector script under `CLAUDE_PLUGIN_ROOT`. The command appears legitimate and scoped, but it is still external code execution that should require user consent.
The line names public YouTube, TikTok, and X oEmbed endpoints for optional metadata lookup. The destinations are normal platform APIs, but the skill may trigger outbound third-party requests.