Youtube Podcast summarizer via Elevenlabs

PassAudited by ClawScan on May 1, 2026.

Overview

The skill’s behavior matches its stated purpose, but it relies on a separately run GitHub backend and paid API keys that users should verify before use.

Before installing, verify the external GitHub backend, review its dependencies, protect the required API keys, and understand that YouTube links may be processed automatically and sent through Supadata, OpenRouter/Cerebras, and ElevenLabs.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You would be trusting code and dependencies that are not included in this skill package.

Why it was flagged

The skill is instruction-only but directs the user to install and run a separate npm backend from GitHub.

Skill content

git clone https://github.com/Franciscomoney/elevenlabs-moltbot.git
cd elevenlabs-moltbot
npm install
cp .env.example .env
# Add your API keys to .env
npm start

Recommendation

Review the GitHub repository and its dependencies before running it or adding API keys.

Note

ASI03: Identity and Privilege Abuse

What this means

Those keys may allow the backend to make paid requests to the associated services.

Why it was flagged

The backend requires provider API keys for text-to-speech, transcript retrieval, and AI summarization.

Skill content

"required_env": [
    "ELEVENLABS_API_KEY",
    "SUPADATA_API_KEY",
    "OPENROUTER_API_KEY"
  ]

Recommendation

Use restricted keys where possible, monitor usage, and avoid sharing the .env file.

Note

ASI02: Tool Misuse and Exploitation

What this means

Processing a YouTube link may create a backend job and consume API credits.

Why it was flagged

The skill declares auto-trigger patterns for YouTube URLs, so it may start its workflow when such links appear.

Skill content

metadata: {"openclaw":{"emoji":"🎙️","autoTrigger":{"patterns":["youtube.com/watch","youtu.be/","youtube.com/shorts"]}}}

Recommendation

Confirm your bot’s auto-trigger behavior and set usage or cost limits if needed.

Note

ASI07: Insecure Inter-Agent Communication

What this means

The video link and derived transcript or summary content may be sent to external providers as part of the intended workflow.

Why it was flagged

The data flow routes YouTube URLs, transcripts, and generated summaries through multiple third-party services.

Skill content

YouTube URL → Supadata (transcript) → AI (summary) → ElevenLabs (voice) → You

Recommendation

Avoid using the skill for private, sensitive, or unlisted video content unless you are comfortable with those providers processing it.