tube-summary

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: tube-summary Version: 1.0.0 The OpenClaw skill 'tube-summary' is benign. Its purpose is to search YouTube videos and summarize their subtitles. All scripts (`youtube-search.py`, `process-subtitles.py`) and instructions in `SKILL.md` are directly aligned with this stated purpose. `youtube-search.py` uses `yt-dlp` via `subprocess` or `requests` for web scraping to interact solely with YouTube, which is necessary for its function. `process-subtitles.py` performs local text processing on VTT files. There is no evidence of data exfiltration, malicious execution, persistence, prompt injection, or obfuscation.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You may need to install third-party packages before the skill works.

Why it was flagged

The skill depends on external Python tooling, but the registry metadata lists no required binaries or install spec. This is disclosed in the instructions and fits the purpose, but users should notice the manual dependency requirement.

Skill content

- `yt-dlp` (install: `pip install yt-dlp`)
- `requests` (for YouTube search fallback)
- Python 3.7+

Recommendation

Install dependencies from trusted package sources and verify yt-dlp, requests, and any needed Python packages are maintained versions.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

Using the skill runs local commands and contacts YouTube through yt-dlp.

Why it was flagged

The script invokes yt-dlp as a subprocess to perform YouTube search. The command is constructed as an argument list rather than shell execution, and this behavior is expected for the skill’s function.

Skill content

result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)

Recommendation

Run it in a normal user directory, review the selected video URL before subtitle download, and avoid using elevated privileges.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The skill can create subtitle files in the directory where the command is run.

Why it was flagged

The workflow downloads subtitle files to the current directory. This is user-directed and purpose-aligned, but it creates local files based on external video content.

Skill content

yt-dlp --write-subs --sub-langs en --skip-download "VIDEO_URL"

Recommendation

Run the subtitle download from a dedicated working folder if you want to keep generated files contained.