YouTube Analytics
v1.0.0YouTube Data API v3 analytics toolkit. Analyze YouTube channels, videos, and search results. Use when the user asks to: check YouTube channel stats, analyze video performance, compare channels, search for videos, get subscriber counts, view engagement metrics, find trending videos, get channel uploads, or analyze YouTube competition. Requires a YouTube Data API v3 key from Google Cloud Console.
⭐ 6· 2.3k·7 current·7 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The skill's name, description, SKILL.md and code all match: it's a YouTube Data API v3 toolkit that needs a YOUTUBE_API_KEY and performs channel/video/search queries. However the registry metadata claims 'Required env vars: none' and 'Primary credential: none', which contradicts the code (scripts/src/config/settings.ts and core/client.ts enforce and use YOUTUBE_API_KEY). That mismatch is incoherent and could lead to missing prompts or accidental credential exposure.
Instruction Scope
SKILL.md instructs running npm install in scripts/, creating a .env with YOUTUBE_API_KEY and optional max results, then calling exported TypeScript functions or running with npx tsx. Runtime behavior is scoped to calling the YouTube API and saving results as JSON under results/{category}/; there are no instructions to read unrelated system files or send data to external endpoints other than Google's YouTube API. Be aware it will write files to the current working directory (results/).
Install Mechanism
There is no custom installer or remote URL; install is standard npm install using package.json (dependencies: dotenv, googleapis, tsx, typescript). No downloads from obscure hosts or archive extracts are present in the manifest. Running npm install will fetch npm packages from the registry (normal but has the usual supply-chain considerations).
Credentials
The code requires YOUTUBE_API_KEY (and optionally YOUTUBE_DEFAULT_MAX_RESULTS) but the skill metadata does not declare any required environment variables or primary credential. Requiring a YouTube API key is proportional for the stated purpose, but the missing declaration is an inconsistency that affects consent and credential-handling policies. The API key is a sensitive secret and should be declared and scoped (restrict referer/IP/usage) before use.
Persistence & Privilege
The skill does not ask for permanent platform-wide presence (always:false) and does not modify other skills or global agent settings. Its persistent action is local auto-saving of JSON results into results/ — expected for an analytics toolkit.
What to consider before installing
This skill appears to implement a legitimate YouTube Data API toolkit, but the registry metadata failing to declare the required YOUTUBE_API_KEY is an important inconsistency. Before installing: (1) confirm the platform will ask you to provide the API key (it is required by the code); (2) create a dedicated API key restricted to the YouTube Data API and limit its usage (IP, HTTP referrer, quotas) to reduce risk; (3) run npm install and execute the code in a sandbox or isolated environment because it will install npm packages and write JSON files to a results/ directory in the project root; (4) inspect the code yourself (or request the publisher/source) if you need assurance there are no hidden endpoints — the code here only calls googleapis and writes local files; and (5) ask the skill author/registry maintainer to update the metadata to list YOUTUBE_API_KEY as a required credential so consent and prompting behave correctly.Like a lobster shell, security has layers — review code before you run it.
latestvk978hdkych08wp5bebp7cnv2td7zz1ya
License
MIT-0
Free to use, modify, and redistribute. No attribution required.