Chromecast With Google Tv
ReviewAudited by ClawScan on May 10, 2026.
Overview
Prompt-injection indicators were detected in the submitted artifacts (you-are-now); human review is required before treating this skill as clean.
This looks coherent for its stated purpose. Install it only if you are comfortable enabling ADB Wireless Debugging on your Chromecast, review or pin the unpinned yt-api helper if supply-chain stability matters, and specify the target device/port when using it to avoid controlling the wrong paired device. ClawScan detected prompt-injection indicators (you-are-now), so this skill requires review even though the model response was benign.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A paired Chromecast or Android TV can be controlled from the host, including launching apps and sending media/input commands.
The skill can issue ADB shell commands to the selected device. This is expected for Google TV control, but it is still a powerful device-control interface.
def adb_shell(args: Sequence[str], device: Optional[str], timeout: int = ADB_TIMEOUT_SECONDS) -> Tuple[int, str]:
return run_adb(['shell', *args], device, timeout=timeout)Use it only with devices you own or administer, and pass the intended --device and --port when possible.
Once paired, the host can reconnect and control the TV over ADB until that pairing/debugging access is removed or disabled.
ADB wireless pairing gives the host delegated debugging/control authority over the Chromecast. This is disclosed and purpose-aligned, but it is a privileged trust relationship.
Before using this skill, you must pair your Chromecast with ADB wireless debugging
Pair only with trusted hosts and disable Wireless Debugging or revoke ADB access when you no longer need the skill.
A future version of the helper dependency could behave differently from the version reviewed here.
The YouTube helper is installed from a Go module using @latest, so the exact installed code can change over time.
go | module: github.com/nerveband/youtube-api-cli/cmd/yt-api@latest | creates binaries: yt-api
Prefer pinning the Go module to a reviewed version or verify the dependency before installing.
If the cache is stale or edited, playback/control commands could go to an unintended paired device.
The skill stores and later reuses device-selection state. This is disclosed and useful, but users should know future commands may target the cached device.
The script caches the last successful IP:PORT to `.last_device.json` in the skill folder and will use that cache if no explicit device is provided.
Specify --device and --port for important actions, and delete or check `.last_device.json` if device selection seems wrong.