ClawHub

YouTube Daily Digest: Auto Monitor & Summary 🥥Meow

v1.0.0

A Python bot that monitors YouTube channels via RSS, summarizes new videos using Google Gemini AI (with audio fallback for videos without subtitles), and sen...

⭐ 1· 97·0 current·0 all-time
by@inkiy
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
medium confidence
ℹ
Purpose & Capability
The skill's requested capabilities (GEMINI_API_KEY, TG_BOT_TOKEN, TG_CHAT_ID) and included Python modules (google-genai, yt-dlp, youtube-transcript-api, requests) are consistent with a bot that fetches transcripts/audio, calls Gemini for summarization, and posts to Telegram. However, the registry metadata incorrectly lists no required environment variables or primary credential while SKILL.md and config.py require them.
✓
Instruction Scope
SKILL.md and the code limit actions to: polling YouTube RSS, reading/writing a local db.json, fetching transcripts or downloading audio with yt-dlp, uploading audio/text to Google Gemini, and sending messages to Telegram. The instructions are explicit about which secrets are required. Notable runtime behaviors: audio files are downloaded to disk (temp_audio) and uploaded to Google; processed video IDs are persisted to db.json.
✓
Install Mechanism
No special install mechanism is bundled; the README recommends using pip install -r requirements.txt. Dependencies are from PyPI (google-genai, yt-dlp, etc.). No downloads from arbitrary URLs or extract/install steps were found.
ℹ
Credentials
The required environment variables (Gemini API key and Telegram bot token/Chat ID) are proportionate and necessary for the described functionality. However, registry metadata incorrectly claims 'none' for required env vars/primary credential — this mismatch should be resolved before trusting automated install/permission tooling.
✓
Persistence & Privilege
The skill does not request platform-wide persistence or elevated privileges. It writes its own db.json and temporary audio files and does not modify other skills or system-wide settings. always:false and normal autonomous invocation settings are used.
Assessment
This skill appears to do what it says: it polls YouTube RSS, extracts transcripts or downloads audio, uploads content to Google Gemini for summarization, and posts summaries to a Telegram chat. Before installing: 1) Be aware you must provide GEMINI_API_KEY, TG_BOT_TOKEN, and TG_CHAT_ID — these are necessary and will be used to talk to Google and Telegram. 2) The bot will download audio to temp_audio/ and persist processed IDs in db.json; run it in a dedicated directory and ensure you are comfortable with audio and transcripts being uploaded to Google. 3) The registry metadata incorrectly omits the required secrets/primary credential — treat that as a configuration/packaging bug; verify env handling in config.py rather than relying on registry declarations. 4) Run the code in a controlled environment (non-root) and inspect or audit logs if you plan to run continuously. If you need higher assurance, rotate tokens/keys after testing and consider restricting the Telegram chat to a test group.

Like a lobster shell, security has layers — review code before you run it.

latestvk976knqrfyxv6410xkgf42vdeh834t4s

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments