YouTube Video Transcript
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: youtube-video-transcript Version: 1.0.0 The skill bundle is designed for a legitimate purpose: fetching, summarizing, and saving YouTube transcripts locally using `yt-dlp`. All file system operations are confined to `~/youtube-video-transcript/` and explicitly require user consent for caching, with strong emphasis on transparency. The markdown instructions for the AI agent consistently reinforce ethical behavior, user privacy, and secure practices (e.g., 'Never ask for or store credentials', 'Cache With Consent'), actively mitigating prompt injection risks rather than exploiting them. There is no evidence of intentional data exfiltration, backdoor installation, or other malicious activities.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A large batch request could consume time, bandwidth, and create many local transcript files.
The skill documents shell-based batch use of yt-dlp. This is aligned with transcript extraction, but it can trigger many external requests and local outputs if the user chooses a large channel or playlist.
Download all transcripts from a channel: ... for id in $(cat video_ids.txt); do yt-dlp --write-auto-sub --sub-lang en --skip-download "https://youtube.com/watch?v=$id"
Use batch workflows only when intended, review the target channel or playlist first, and apply the provided rate-limiting guidance for large jobs.
Installing a command-line dependency adds trust in the package manager source and installed yt-dlp package.
The skill relies on an external command-line package. That dependency is central to the stated purpose and disclosed, but it is still an external install path.
Options: `brew install yt-dlp` (macOS) or `pip install yt-dlp`
Install yt-dlp only from trusted package managers or official project instructions, and keep it updated.
Providing cookies may allow yt-dlp to access YouTube as your logged-in account for that request.
The skill mentions optional cookie-based access for age-restricted videos. Browser cookies can represent account session access, but the artifact frames this as user-provided and says not to ask for or store credentials.
yt-dlp supports cookies: `--cookies cookies.txt`; User must provide their own browser cookies; Never ask for or store credentials
Only provide cookies if you understand what is in the file, use a narrowly scoped cookies export when possible, and do not share passwords or long-lived credential files.
Saved transcripts and preferences may be reused in later tasks and remain on disk until deleted.
The skill stores transcript caches and preferences in a persistent local directory. The artifacts disclose the location and require user consent before caching.
For each processed video (only with user consent), create `~/youtube-video-transcript/videos/{video_id}.md`Enable caching only if you want transcripts retained locally, and ask the agent to show or delete saved files when needed.