Edison Youtube Full
v1.0.0Complete YouTube toolkit for agents: search videos, fetch metadata, browse channels and playlists, and pull transcripts. Use when you need comprehensive YouT...
⭐ 0· 434·3 current·3 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (YouTube toolkit) align with the instructions (YouTube Data API calls and transcript extraction). Requested libraries (requests, youtube-transcript-api) and an API key are proportionate to the stated purpose. However, the registry metadata claims no required env vars and no code files, while SKILL.md explicitly requires a YOUTUBE_API_KEY and describes multiple local scripts — this metadata vs. instructions mismatch is unexpected.
Instruction Scope
SKILL.md instructs the agent/user to set an environment variable (YOUTUBE_API_KEY), install Python deps via pip, and run a set of local Python scripts under scripts/*.py. Those instructions are narrow and on-purpose for a YouTube tool, but the referenced scripts and requirements.txt are not present in the package manifest. That gap means the instructions cannot be executed as-is and could hide missing behavior if the code comes from an external source later.
Install Mechanism
There is no install spec (instruction-only), which minimizes automated installation risk. The SKILL.md recommends running pip install -r scripts/requirements.txt (typical for Python projects) — this implies downloading PyPI packages at runtime, which is expected but should be reviewed. The bigger risk is the absence of the scripts/requirements.txt file in the package; the user would need to obtain code from elsewhere.
Credentials
The SKILL.md requires a YOUTUBE_API_KEY (appropriate for this functionality), but the registry metadata incorrectly lists no required env vars. There are no extra unrelated credentials requested. The inconsistency between declared requirements and the runtime instructions is problematic: users may be unaware a key is needed or may be prompted to supply secrets to an external/unknown code source.
Persistence & Privilege
The skill does not request persistent/always-on privileges and uses default autonomous invocation settings. It does not declare modifications to other skills or system-wide settings. No elevated persistence is requested.
What to consider before installing
This skill's README looks like a normal YouTube CLI toolkit, but the package is incomplete: SKILL.md expects local scripts and a YOUTUBE_API_KEY while the registry entry lists no env vars or code files. Before installing or running anything, ask the publisher for the missing repository or the actual scripts/requirements.txt so you can inspect the code. If you must run it: (1) only provide a YouTube API key with least privilege and consider using a dedicated key for this tool, (2) run pip installs inside an isolated virtualenv or container and review requirements.txt, and (3) review the actual scripts for network calls, arbitrary shell execution, or data exfiltration. If the publisher cannot supply source code or a trustworthy origin (e.g., GitHub repo/official release), treat the skill as untrusted.Like a lobster shell, security has layers — review code before you run it.
latestvk97fthyyg2p4azj64xg6gpr6h982f44m
License
MIT-0
Free to use, modify, and redistribute. No attribution required.