Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Chromecast With Google Tv
v1.2.0Cast YouTube videos, Tubi TV show episodes, and TV show episodes from other video streaming apps via ADB to Chromecast with Android TV (Chromecast 4K supported, Google TV Streamer support is unknown)
⭐ 0· 1.3k·0 current·0 all-time
by@antgly
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Required binaries (adb, scrcpy, yt-api, uv) and the brew/go install steps match the described functionality (ADB device pairing/control, UI fallback via scrcpy, YouTube ID resolution via yt-api). No unrelated cloud credentials or surprising privileges are requested.
Instruction Scope
Runtime instructions stay within the stated scope: they pair/connect via adb, launch intents for YouTube/Tubi, and perform UI automation for global-search via scrcpy + adb. The skill writes a local cache (.last_device.json) containing ip/port (documented). The SKILL.md mentions using a 'web_search' helper to canonicalize Tubi URLs but the repository does not include a dedicated web_search component — this is a minor documentation vagueness, not an obvious exfiltration step. Environment variables referenced (CHROMECAST_HOST, CHROMECAST_PORT, YOUTUBE_PACKAGE, TUBI_PACKAGE) are configuration-only and not secrets.
Install Mechanism
Install entries use Homebrew formulas for platform tools/scrcpy/uv and a go module for yt-api (github.com/nerveband/youtube-api-cli). These are traceable, standard mechanisms for the declared dependencies; no arbitrary downloads or extract-from-unknown-URLs were found.
Credentials
The skill requires no credentials or secret env vars. Optional env vars are configuration flags (device IP/port and package overrides). Saving the last-used device IP:PORT locally is appropriate for usability but note it records local network addressing information.
Persistence & Privilege
The skill does not request always:true and does not attempt to modify other skills or system-wide agent settings. It persists only its own .last_device.json cache in the skill folder and relies on user-installed binaries.
Scan Findings in Context
[prompt-injection:you-are-now] expected: Scanner flagged the substring pattern 'you-are-now' found in the SKILL.md. This appears in the pairing instructions ('You are now a developer!') shown when enabling Developer Options and is benign in this context.
Assessment
This skill appears to do what it says: control a Chromecast with Google TV over ADB. Before installing, verify you are comfortable enabling Developer Options and Wireless Debugging on the Chromecast (pairing exposes an adb pairing flow). Review and be comfortable with the install steps (Homebrew and a go binary for yt-api). The skill will store the last-connected device IP:PORT in .last_device.json in the skill folder — don't commit or share that file if it contains private network info. The SKILL.md mentions a 'web_search' lookup flow for Tubi URLs which is not present as a separate service in the repository; expect that behavior to be limited or manual. If you run this in an environment where arbitrary ADB commands are sensitive, audit the code (google_tv_skill.py and play_show_via_global_search.py) yourself — they use subprocess/adb to send intents and key events, which is expected for this functionality. Autonomous invocation (the agent calling the skill) is allowed by default; that is normal but if you want to restrict automatic runs, disable autonomous invocation in your agent settings.Like a lobster shell, security has layers — review code before you run it.
latestvk97bv655r3yn8bb0avvbts3mtx8136fc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
OSmacOS · Linux
Binsadb, scrcpy, uv, yt-api
Install
Install adb (android-platform-tools)
Bins: adb
Install scrcpy
Bins: scrcpy
brew install scrcpyInstall uv
Bins: uv
brew install uvInstall yt-api (go)
Bins: yt-api
go install github.com/nerveband/youtube-api-cli/cmd/yt-api@latest