Index Youtube
Analysis
The skill mostly matches its YouTube indexing purpose, but it includes optional use of Chrome browser cookies for authenticated YouTube access without clear scope or consent boundaries.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
pip install solograph # or uvx solograph
The skill tells the user or agent to install or run external package-registry software, but the package version and provenance are not pinned in an install spec.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
Reduce `-n` limit, add `--sleep-interval 2` to yt-dlp commands, or use `--cookies-from-browser chrome` for authenticated access.
This explicitly recommends using the user's Chrome browser session cookies for authenticated YouTube requests, while the metadata declares no credential requirement and the instructions do not define consent, scope, or handling boundaries.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Write a summary index to `docs/youtube/index.md`
The skill creates a persistent searchable index of downloaded transcripts and summaries, which is central to its purpose but may be reused in later searches.