andrebrov/viral-scout
Find high-performing short-form videos on AI × e-commerce topics across YouTube and Instagram, in English and Russian, filtered by view count. Presents a shortlist for the user to pick from, then saves the picks to the shared reel backlog with a note on what format or hook is worth stealing. Use when the user asks what is working on video right now, wants viral video references, wants ideas for what to shoot, or says "viral scout" / "what's popping". Research and selection only — no video is produced here.
77
97%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The workflow fetches video search results and profiles from YouTube and Instagram via `find_viral.py`, ingesting outsider-authored video titles and captions into the agent's context.
Where we found it
www.youtube.com
domain · 1 site
The script fetches YouTube search results pages and parses embedded ytInitialData JSON containing outsider-authored video titles, channels, and view counts.
scripts/find_viral.py
51
url = "https://www.youtube.com/results?" + urllib.parse.urlencode(
i.instagram.com
domain · 3 sites
The script fetches Instagram's web_profile_info API endpoint and parses outsider-authored video captions and play counts from public accounts.
scripts/find_viral.py
84
url = ("https://i.instagram.com/api/v1/users/web_profile_info/?"
10
Instagram i.instagram.com/api/v1/users/web_profile_info returns recent media
SKILL.md
18
- **Instagram** — `i.instagram.com/api/v1/users/web_profile_info` returns recent
- Audited
- Security analysis