YouTube Digest
v1.0.0Understand, summarize, translate, and extract key points from YouTube videos. Use when a user provides a YouTube URL and wants: (1) a Chinese summary, (2) a...
⭐ 0· 67·0 current·0 all-time
by@benheee
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match the included fetch_youtube.py script and usage docs. Requested tools (yt-dlp, deno, ffmpeg) are appropriate for subtitle/video extraction and optional frame extraction; nothing extraneous (no cloud credentials or unrelated binaries) is required.
Instruction Scope
SKILL.md tells the agent to run the provided script, read summary.json/transcript.txt, and optionally run ffmpeg for frames. It does not instruct the agent to read unrelated system files or hidden config, nor does it send collected content to unexpected external endpoints. The proxy option is explicitly for yt-dlp and is reasonable for bypassing rate limits.
Install Mechanism
There is no formal install spec in the skill bundle (instruction-only), but README recommends installing yt-dlp from GitHub releases and deno via deno.land install.sh. Those are well-known release hosts; however, running curl|sh or installing binaries from the network is always a moderate operational risk—verify sources and consider package-manager installs where possible.
Credentials
The skill requests no environment variables or credentials. The optional --proxy argument is the only network-related parameter; it does not demand tokens or secrets from unrelated services. The files written (summary.json, transcript.txt) are expected outputs for the described functionality.
Persistence & Privilege
always is false and the skill is user-invocable. It writes outputs to the user-specified directory and does not modify other skills, system-wide agent settings, or require permanent presence. Autonomous invocation defaults are unchanged and not a concern by themselves.
Assessment
This skill appears to do what it says: it runs yt-dlp (an external binary) to fetch subtitles/metadata, converts subtitles to a transcript, and relies on the agent's LLM to summarize/translate. Before installing, consider: (1) you will need yt-dlp and deno (README shows curl|sh installs—verify sources or use your distro/package manager), (2) transcripts and summary.json are written to disk and will be read by the agent and sent to the LLM—treat these outputs as potentially sensitive data, (3) the README suggests using residential proxies if running from cloud IPs; avoid sending proxy credentials to untrusted parties, and (4) run the skill in a sandboxed environment or with restricted file permissions if you are worried about content or supply-chain risk. Overall the bundle is internally consistent and not requesting unrelated privileges.Like a lobster shell, security has layers — review code before you run it.
latestvk977wh9ysr2c0q0qknhtfzqjes83q1h0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.