Skillv1.0.1

ClawScan security

youtube-search-api-skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 12, 2026, 12:05 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code, runtime instructions, and requested environment variable align with its stated purpose (calling BrowserAct's YouTube search workflow) and contain no obvious incoherent or hidden behavior.
Guidance: This skill appears to do what it says: it uses your BROWSERACT_API_KEY to call BrowserAct's API and print structured YouTube search results. Before installing, make sure you trust BrowserAct and are comfortable the API key will be used to make queries to https://api.browseract.com. Confirm any data privacy or billing implications in your BrowserAct account (calls may consume quota). Also ensure the agent environment has Python and the 'requests' library available (pip install requests if needed). Do not share your API key with untrusted parties; if you stop using the skill, revoke or rotate the key in your BrowserAct console if you have concerns.

Purpose & Capability: okThe skill's name and description match its implementation: the script calls BrowserAct endpoints (api.browseract.com) to run a search workflow and returns parsed results. The only required environment variable is BROWSERACT_API_KEY, which is exactly what an integration with BrowserAct needs.
Instruction Scope: okSKILL.md instructs the agent to check for BROWSERACT_API_KEY, run the provided Python script with search parameters, monitor terminal logs, and follow a limited retry logic. The instructions do not request unrelated system files, credentials, or external endpoints beyond BrowserAct.
Install Mechanism: noteThere is no install spec (instruction-only + a small script), which is low risk. Minor inconsistency: the script uses the Python 'requests' library but the skill does not declare or install that dependency. The agent environment must have 'requests' available or the user should be instructed to pip-install it.
Credentials: okOnly BROWSERACT_API_KEY is required and it is necessary for authenticating to BrowserAct. No other secrets, unrelated credentials, or config paths are requested.
Persistence & Privilege: okThe skill is not marked always:true and does not request elevated or persistent system presence. It does not modify other skills or system-wide settings.