YouTube Live Broadcast Checking

Check and manage YouTube channels to find their next scheduled live broadcasts using the YouTube Data API v3 and a Google API key.

Security Scan

The skill is internally consistent with its stated purpose: it only needs a YouTube Data API key, uses googleapis to query public YouTube data, and stores a local watchlist file — nothing in the files indicates unrelated or covert behavior.

Purpose & Capability

Name/description, SKILL.md, plugin metadata, and code all align: the skill queries YouTube Data API v3 and requires a YOUTUBE_API_KEY. There are no unrelated credentials, binaries, or config paths requested.

Instruction Scope

Runtime instructions are focused on getting/using a YOUTUBE_API_KEY and installing dependencies. The code reads/writes a watchlist at ~/.openclaw/workspace/memory/youtube-channels.json (declared in SKILL.md). Network access is limited to Google APIs via the googleapis library. This persistent watchlist is global to the user home (workspace-agnostic), which is expected for a watchlist but is worth noting.

Install Mechanism

There is no remote download-from-URL; installation is via npm (package.json lists googleapis). package-lock.json is included and points to npm registry packages. This is a common, moderate-risk install path (npm packages are externally fetched). The dependency tree includes gcp-metadata/google-auth libraries (normal for googleapis); those libraries may attempt metadata access in certain cloud environments but are not evidence of malicious behavior here.

Credentials

Only YOUTUBE_API_KEY is required and is consistent with the skill's function. The SKILL.md and code both reference this same variable; no other SECRET/TOKEN/PASSWORD env vars are requested.

Persistence & Privilege

The skill is not always-enabled and uses normal autonomous invocation. It persists a watchlist to the user's home (~/.openclaw/.../youtube-channels.json), which can be shared across agent runs; this is expected for a watchlist but may surprise users expecting per-agent isolation.

Assessment

This skill appears to do what it says: it queries YouTube with a YOUTUBE_API_KEY and keeps a small watchlist file in your home directory. Before installing: (1) create a YOUTUBE_API_KEY restricted to the YouTube Data API (and further restrict by referrer/IP if possible); (2) run npm install in a controlled/sandboxed environment and inspect node_modules if you are concerned; (3) be aware the watchlist is stored at ~/.openclaw/workspace/memory/youtube-channels.json (shared across agent runs) — back it up or relocate if you need per-agent isolation; (4) monitor API key usage and quota and revoke the key if you see unexpected requests. If you want extra assurance, review skill.js yourself or run the skill in an isolated container before granting it access to your normal environment.

YouTube Live & Upcoming Broadcast Checking Skill

As the live broadcast of the YouTube app may miss live broadcast notifications even if enabled, I developed this skill to check the next live broadcast time so that we won't miss the live broadcasts we like.

Prerequisites

This skill requires a Google API key with YouTube Data API v3 enabled.

Getting a YouTube API Key

1. Go to the Google Cloud Console
2. Create a new project or select an existing one
3. Enable the YouTube Data API v3:
   • Navigate to "APIs & Services" → "Library"
   • Search for "YouTube Data API v3"
   • Click "Enable"
4. Create credentials:
   • Navigate to "APIs & Services" → "Credentials"
   • Click "Create Credentials" → "API Key"
   • Copy the generated API key
5. (Optional but recommended) Restrict the API key:
   • Click on the API key name
   • Under "API restrictions", select "Restrict key"
   • Choose "YouTube Data API v3"

Setting the API Key

Set the YOUTUBE_API_KEY environment variable:

export YOUTUBE_API_KEY="your_api_key_here"

To make it permanent, add it to your shell profile (~/.bashrc, ~/.zshrc, etc.) or use a .env file.

Important: This skill uses the Google API key solely for read-only access to public YouTube data. No user data is stored or transmitted beyond the API calls to YouTube. The API key should be kept secret and never committed to version control.

Security

This skill:

• Uses the YouTube Data API with an API key (no OAuth tokens stored)
• Does not store any user data beyond the watchlist (channel IDs and names)
• All errors are sanitized to avoid information leakage
• Input validation: channel IDs are validated before API calls
• No command injection risks (parameterized API calls)

Tools

add_channel

Adds a YouTube channel to the watchlist. Accepts human-friendly identifiers: channel ID (UC...), custom URL (@handle), or full channel URL.

Parameters:

• channel_id (string): YouTube channel ID, handle (@name), or full URL

Returns: { id, name, status: "added" } or { error }

remove_channel

Removes a channel from the watchlist.

Parameters:

• channel_id (string): Channel ID or handle

Returns: { removed: true } or { error }

list_channels

Lists all watched channels with names and timestamps.

Returns: Array of { id, name, added_at }

get_next_broadcast

Fetches the earliest upcoming broadcast for a specified channel.

Parameters:

• channel_id (string): Channel ID or handle

Returns: Broadcast object with channel_id, channel_name, video_id, title, scheduled_start_time, thumbnail_url, video_url; or null if none scheduled; or { error } on failure.

check_upcoming_broadcasts

Fetches upcoming broadcasts for multiple channels (or all watchlist if none specified). Results sorted by start time.

Parameters:

• channel_ids (array of strings, optional): Channel IDs or handles. If omitted, uses watchlist.

Returns: Array of broadcast objects (one per channel with upcoming streams), sorted ascending by scheduled_start_time. Omits channels with no upcoming broadcasts.

Installation

1. Extract the skill to workspace/skills/youtube-live-broadcast-checking/
2. Important: If you obtained a package that includes node_modules/, you can use it directly. If building from source, run:

   npm install --no-bin-links
   

   The --no-bin-links flag is required in Docker/overlayfs environments to avoid symlink errors (e.g., uuid package).
3. Ensure YOUTUBE_API_KEY environment variable is set (see Prerequisites).
4. Add "youtube-live-broadcast-checking" to your agent's skills list in openclaw.json
5. Restart the OpenClaw gateway

Watchlist Storage

The skill stores the channel watchlist in:

~/.openclaw/workspace/memory/youtube-channels.json

This location is independent of any specific agent workspace.

Notes

• Quota: Each check costs ~3-5 API units per channel (channels.list + search.list + videos.list)
• Only public channels and publicly scheduled streams are supported
• Channel IDs must be valid; handles (e.g., @SamiLiveHK) are resolved via search (note: the actual display name "Sami Live HK" includes spaces, but the handle does not)
• The skill requires the YOUTUBE_API_KEY environment variable (not GOOGLE_API_KEY)

Version History

• 1.2.0 - Fixed inconsistencies: unified env var to YOUTUBE_API_KEY, standardized watchlist path, added requiredEnvVars in plugin metadata, security review
• 1.1.0 - Initial enhanced version with human-friendly identifier resolution and upcoming broadcast tools
• 1.0.0 - Initial release (deprecated)